topic Re: how i can compare last 5 fields and exclude from result in Splunk Search

how i can compare last 5 fields and exclude from result

saghiralmani — Thu, 16 Apr 2020 09:14:18 GMT

i want to compare if last 5 digits of user ID are same don't show in result
how it can be done

0012345
abc0012345
xyx\0012345

if the resulting values are above as a user ID, i want to check if last 5 values(12345) are same so it should not trigger in my search as a result of user ID

Re: how i can compare last 5 fields and exclude from result

renjith_nair — Thu, 16 Apr 2020 11:01:15 GMT

@saghiralmani ,

If you want to compare the extracted IDs against another value, try

|rex field=your_user_id_field "(?<extracted_id>\d{5}$)"

|eval extracted_id=substr(your_user_id_field,-5)

Compare extracted_id against with the value

Re: how i can compare last 5 fields and exclude from result

harishalipaka — Thu, 16 Apr 2020 11:54:28 GMT

hi @saghiralmani

base search . . .. |eval test=substr(user_id_field,-5) |eventstats  count by test |where count > 1