topic Re: compare two field values for equality in Splunk Search

compare two field values for equality

EricPartington — Wed, 26 Sep 2012 16:25:36 GMT

I have the output of a firewall config, i want to make sure that our naming standard is consistent with the actual function of the network object.

I have a table of the name of the object and the subnet and mask. I want to compare the name and name-combo fields to see if they are the same, and show only those that are not the same.

example row
cluster name name-combo subnet bits match
1 FW1-2 NET69.90.64.0-20 NET69.90.64.0-20 69.90.64.0 20 No Match
2 FW1-2 NET69.90.63.0-8 NET69.90.63.0-20 69.90.64.0 20 No Match

here is my search

`abc_firewall_rules` eventtype=subnet [search index="abc_rules" eventtype=subnet | dedup cluster | fields + source] 
| dedup name,cluster | eval name-combo="NET".subnet."-".bits 
| eval match=if(name-combo=name,"Match","No Match")
|  table cluster,name,name-combo,subnet,bits,match

row 1 should show match and row 2 should show no match..

have tried using | where NOT name=name-combo
have tried using | where name!=name-combo

all show ro results found but in my sample data there are rows that do not match and should show up..

any ideas ?

Re: compare two field values for equality

sdaniels — Wed, 26 Sep 2012 18:39:38 GMT

I usually do some checks on my fields when this happens using eval to makes sure that i'm comparing what I expect. This should be comparing string to string but make the types are ok "eval test = if( isstr(name)", "String", "Not String" } table test)". Everything looks good as far as i can tell.

Re: compare two field values for equality

lguinn2 — Wed, 26 Sep 2012 18:45:55 GMT

If your search is working properly, you should have output, regardless of whether things match or not. Does this search return any results? What does the search job inspector say?

`abc_firewall_rules` eventtype=subnet [search index="abc_rules" eventtype=subnet | dedup cluster | fields + source]

I am guessing that this is a problem with your search, not your logic.

Re: compare two field values for equality

EricPartington — Wed, 26 Sep 2012 18:47:22 GMT

well getting somewhere now..

appears that my field name-combo is not a string (thanks for your test command).

so i tried to convert the field to string with
eval name-combo=tostring(name-combo)
however not able to get a "string" output from that

Re: compare two field values for equality

EricPartington — Wed, 26 Sep 2012 18:48:53 GMT

the search is fine, i get results from that search, the problem appears to be the concat string isnt coming out as a string to compare with

Re: compare two field values for equality

lguinn2 — Wed, 26 Sep 2012 22:37:29 GMT

I think I have it figured out - it's a weird one! Field names are supposed to contain letters, numerals or the underscore, and must start with a letter. name-combo violates this rule, but Splunk doesn't complain! The reason why it doesn't work is that in the if statement, Splunk interprets your test as `name - combo = name" - this will never match...

So change name-combo to name_combo and it should work.

Re: compare two field values for equality

brettcave — Mon, 28 Jan 2013 08:27:22 GMT

i have a similar problem. I apply a filter after stats:

stats dc(field1) as someCount dc(someThing) as otherCount by group | search NOT someCount=otherCount

The above search returns all values, regardless of whether they match or not, so assuming its checking where someCount matches a literal of "otherCount". This works:

... | eval countDiff=someCount-otherCount | search NOT countDiff=0

HTH

Re: compare two field values for equality

lguinn2 — Fri, 08 Feb 2013 20:43:51 GMT

Actually Brett, your problem is different.

| search NOT someCount=otherCount

is interpreted as

| search NOT someCount="otherCount"

search always searches for name=value, whether you use the quotes around the value or not. You could make the first search work by using where instead:

... | stats dc(field1) as someCount dc(someThing) as otherCount by group | where NOT someCount=otherCount

Re: compare two field values for equality

payal4296 — Fri, 12 Mar 2021 17:01:41 GMT

what if 1 field with string "A" is the substring of flied "B"?
|where B=*A* ,
how can we find out that?

Re: compare two field values for equality

scelikok — Sat, 13 Mar 2021 15:27:27 GMT

Hi @payal4296,

Please try below; checking if field A is a substring of field B...

| eval A="%".A."%" | where B like A