https://community.splunk.com/t5/Splunk-Search/How-to-use-where-to-compare-field-values/m-p/420410#M120842 <P>Put the <CODE>where</CODE> clause before the <CODE>stats</CODE> to reduce the number of events to process.</P> <PRE><CODE>... | where 'x' != 'y' | stats count by x,y </CODE></PRE> <P>The single quotes tell Splunk to treat x and y as field names rather than strings.</P> Wed, 12 Jun 2019 16:57:05 GMT richgalloway 2019-06-12T16:57:05Z https://community.splunk.com/t5/Splunk-Search/How-to-use-where-to-compare-field-values/m-p/420408#M120840 <P>Let's say I'm doing a stats count by x,y</P> <P>How would I formulate a WHERE that compares the string value of x and y and only returns the stats count when there's a difference. </P> <P>So like stats count by x,y <CODE>|where x != y</CODE> </P> Wed, 12 Jun 2019 15:45:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-where-to-compare-field-values/m-p/420408#M120840 summitsplunk 2019-06-12T15:45:54Z https://community.splunk.com/t5/Splunk-Search/How-to-use-where-to-compare-field-values/m-p/420409#M120841 <P>@summitsplunk Is your query not working. What are the values in x and y can you give an example.</P> Wed, 12 Jun 2019 15:55:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-where-to-compare-field-values/m-p/420409#M120841 Vijeta 2019-06-12T15:55:03Z https://community.splunk.com/t5/Splunk-Search/How-to-use-where-to-compare-field-values/m-p/420410#M120842 <P>Put the <CODE>where</CODE> clause before the <CODE>stats</CODE> to reduce the number of events to process.</P> <PRE><CODE>... | where 'x' != 'y' | stats count by x,y </CODE></PRE> <P>The single quotes tell Splunk to treat x and y as field names rather than strings.</P> Wed, 12 Jun 2019 16:57:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-where-to-compare-field-values/m-p/420410#M120842 richgalloway 2019-06-12T16:57:05Z