topic Re: How to compare two fields from two different index and display results with match or No-match? in Splunk Search

How to compare two fields from two different index and display results with match or No-match?

rohitnaz007 — Mon, 07 Dec 2020 12:13:38 GMT

I am running 2 different Index and have to compare each value in field 1 from 1st index with the values in field2 from index 2 . & also regex is used for other field value. The display result should show a match or a Non Match against each value.

Given Data:

(index=cmi cef_vendor="Imperva Inc." cef_product="WAF" dvc="10.124.1.202" act="None" cs2="*" deviceSeverity=High) OR (index=case_management DeviceProduct=WAF fname IN ("*CMI - WAF*"))

| rex field=fname "(-)(?(\s)(PROD|SFR)+(\s))(-)(?(\s)[\w]+(\s)[\w]+(\s))(?(\d)+(\s))(-)"

| eval m=coalesce(cn1,alert)

| stats values(cn1) as cn1 values(alert) as alert by m

| table cn1 alert m

Results should be something like this table:

cn1 alert m

453626 453626 Match

453624 453626 No Match

@elrich11

Re: How to compare two fields from two different index and display results with match or No-match?

richgalloway — Mon, 07 Dec 2020 13:45:34 GMT

What results do you get from that query? How do those results differ from the desired results?

The coalesce function does not compare fields. Use if to do that.

| eval m = if(cn1==alert, "Match", "No Match")

Re: How to compare two fields from two different index and display results with match or No-match?

rohitnaz007 — Mon, 07 Dec 2020 19:18:29 GMT

Reply got from that query as below,

cn1	alert	m
	4361101	4361101
4361645		4361645
	4361645	4361645
4361738		4361738

& as per your solution,

| eval m = if(cn1==alert, "Match", "No Match")

gives result as below,

cn1	alert	m
4369221		No Match
	4369135	No Match
	4369135	No Match
4369418		No Match

@richgalloway @elrich11

want to Expected result Like this,

cn1	alert	m
4369221	4369221	Match
4369222	4369135	No Match
4369243	4369135	No Match
4369418		No Match