https://community.splunk.com/t5/Splunk-Search/How-to-compare-different-fields-having-the-same-value-in/m-p/339393#M100630 <P>It worked.</P> <P>Many thanks!</P> Tue, 13 Mar 2018 05:30:37 GMT pratibha2018 2018-03-13T05:30:37Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-different-fields-having-the-same-value-in/m-p/339391#M100628 <P>How to compare different fields having the same value and though in different events?<BR /> For example : index1, source1, sourcetype1 has "n" events and index2, source2, sourcetype2 has "m" events .<BR /> Now, some fields from sourcetype1(say field1) have the same values as that of some fields of sourcetype2(sayfield2).<BR /> I want for field1=field2 list all the other fields of sourcetype2,sourcetype1. The thing is that I have to compare it in different events.<BR /> Not a single event is having both field1 and field2.</P> Mon, 12 Mar 2018 12:57:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-different-fields-having-the-same-value-in/m-p/339391#M100628 pratibha2018 2018-03-12T12:57:16Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-different-fields-having-the-same-value-in/m-p/339392#M100629 <P>Hi</P> <P>Try this and let me know please</P> <PRE><CODE>index2 source2 sourcetype2 [ search index1 source1 sourcetype1 | dedup field1 | return 1000 field2=field1 ] | fields - field2 </CODE></PRE> Mon, 12 Mar 2018 13:07:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-different-fields-having-the-same-value-in/m-p/339392#M100629 tiagofbmm 2018-03-12T13:07:54Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-different-fields-having-the-same-value-in/m-p/339393#M100630 <P>It worked.</P> <P>Many thanks!</P> Tue, 13 Mar 2018 05:30:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-different-fields-having-the-same-value-in/m-p/339393#M100630 pratibha2018 2018-03-13T05:30:37Z