topic How to compare 2 columns of a table when we use 'chart' command ? in Splunk Search

How to compare 2 columns of a table when we use 'chart' command ?

georgear7 — Wed, 10 Jun 2020 19:59:51 GMT

I have used the below query to create one table:

index=abc sourcetype=xyz source=*.txt host=host1 OR host=host2 | rex field=source "/abcdef(?<EAR_Name>\w+.*ear)/versionInfo.txt" | rex field=source "/xyzpqrs(?<EAR_Name>\w+.*ear)/versionInfo*.txt" | rex field=_raw "deployTag=\d+\@\w+.*@(?<Label>\w+.*)" | chart latest(Label) by EAR_Name,host

My current table is,

EAR_Name host1 host2
mobile.ear sg.mobile-12 sg.mobile-10
google.ear hk.google-45 hk.google-45
facebook.ear th.fb-37 th.fb-37

here..sg.mobile-12, hk.google-45 values of Label..

My requirement is to compare(row-wise) each value of host1 column with host2 column..and produce the output like "Matching","Not Matching"...like below:

EAR_Name host1 host2 Result
mobile.ear sg.mobile-12 sg.mobile-10 Not Matching
google.ear hk.google-45 hk.google-45 Matching
facebook.ear th.fb-37 th.fb-37 Matching

Re: How to compare 2 columns of a table when we use 'chart' command ?

rnowitzki — Wed, 10 Jun 2020 12:20:58 GMT

Hi,

this will do it:

| eval Result=if(host1==host2,"Matching", "Not Matching")

Re: How to compare 2 columns of a table when we use 'chart' command ?

georgear7 — Thu, 11 Jun 2020 00:40:23 GMT

@rnowitzki it's not working as expected. I got Result as "Non Matching" for all the rows even though identical values present for host1=host2.

Re: How to compare 2 columns of a table when we use 'chart' command ?

georgear7 — Thu, 11 Jun 2020 12:26:20 GMT

Hi @skakehi_splunk, Can you help me here for this query ?

Re: How to compare 2 columns of a table when we use 'chart' command ?

skakehi_splunk — Thu, 11 Jun 2020 17:49:03 GMT

@georgear7 Looks like @rnowitzki 's answer is the solution.

Did you try to add the solution to end of the line? (like this)
If it doesn't work, let me know your SPL and sample results of Not Matching.

Just to be sure, check the result of the rex command on the third line you posted in your question.
My concern is that the regular expression "versionInfo*.txt" is probably does not match filename such as "versionInfo20200611.txt". In this case, like "versionInfo.*.txt" or "versionInfo\d+.txt" works.
If the regular expression works correctly and extracts the information you want, you are good to go.

Re: How to compare 2 columns of a table when we use 'chart' command ?

georgear7 — Fri, 12 Jun 2020 02:29:07 GMT

Thanks both @skakehi_splunk @rnowitzki ..My actual server name is something like below.

host-03u, host-04u..So when i used eval command, i forgot to put single quote in server name. So i didn't get the expected result.

Now after giving single quote in server name, it's working fine.

Thanks @skakehi_splunk once again for your reply here..

Re: How to compare 2 columns of a table when we use 'chart' command ?

Ashwini_5 — Sun, 15 Aug 2021 11:44:38 GMT

Hi @georgear7 ,

Have you found solution for this scenario? If so, Kindly share it.