topic How do you compare 2 fields in different indexes to add a third field? in Splunk Search

How do you compare 2 fields in different indexes to add a third field?

ppiton — Fri, 28 Dec 2018 13:28:45 GMT

Hello,

I can't find out how to do a search to compare the same value in 2 fields, and if this is same value, add a third field.

For exemple:
index1 with field1Index1 and field2Index1
index2 with field1Index2

In the search, if field1Index1 = field1Index2 then display field1Index1 and field2Index1
NB: field1Index1 associated to field2Index1in index1

I found different subjects on the forum with eval, if... but not with all that conditions.

Can you help me?

Thank you.

Re: How do you compare 2 fields in different indexes to add a third field?

saurabhkharkar — Fri, 28 Dec 2018 14:17:27 GMT

Can you try this ?
This will return results only if field1Index1=field1Index2

Re: How do you compare 2 fields in different indexes to add a third field?

ppiton — Fri, 28 Dec 2018 14:33:13 GMT

Ok but i don't need to set values 4 or 7.
I need to use values of search.
Thank you.

Re: How do you compare 2 fields in different indexes to add a third field?

saurabhkharkar — Fri, 28 Dec 2018 14:38:47 GMT

yeah, all you have to use is

index=index1 OR index=index2
| eval field1Index1New =case(field1Index1=field1Index2,field1Index1,field1Index2=field1Index1,field2Index1,1=0,0)
| where field1Index1New!=""
| table field2Index1 field1Index1New