topic Re: Omitting matching fields unless blank in Splunk Search

Omitting matching fields unless blank

aherrington — Fri, 05 Apr 2019 11:28:49 GMT

Hello,

I'm trying to omit rows that contain matching fields, unless those fields are blank. Example syntax below:

| where field1 != field2 UNLESS field1=" "

Obviously the UNLESS won't work, but I've put it in there for arguments sake. An OR doesn't work in the above syntax, as if field1 is blank, field2 is blank too which would make the NOT EQUALS result in omitting the row.

Re: Omitting matching fields unless blank

chrisyounger — Fri, 05 Apr 2019 11:32:12 GMT

Try this: | where field1 != field2 AND (field1 != "" OR field2 != "")

Re: Omitting matching fields unless blank

aherrington — Fri, 05 Apr 2019 13:33:08 GMT

Ended up having to convert one of my fields using the eval field=tostring(field1) to get the comparison to work in the end, but it worked as expected. Thanks.