https://community.splunk.com/t5/Splunk-Search/How-to-compare-2-field-values-and-exclude-matching-results-from/m-p/474487#M192481 <P>Below is my search output for the SPL i am running.</P> <P>`<BR /> <STRONG>db_1</STRONG><BR /><BR /> oracle_test<BR /><BR /> db2_bio<BR /><BR /> oracle_890<BR /><BR /> n88888<BR /><BR /> n7777 </P> <P><STRONG>server_2</STRONG><BR /><BR /> n87896<BR /> bg8768<BR /> j987653<BR /> n88888<BR /><BR /> n7777<CODE></CODE> </P> <P>How do i exclude the field records which are identical between 2 fields like in this case -- (n88888 &amp; n7777)</P> <P>I tried using there where clause /Search , but without any success ..</P> <P>SPL used to display fields records which are not identical ---</P> <P>|splunk command | where db_1 != server_2 ( Not wokring )</P> <P>|splunk Command | fields db_1,server_2 | search db_1 !=server_2 ( Not working )</P> <P>Any clue/help will be appreciated ?</P> Wed, 30 Sep 2020 04:15:05 GMT promukh 2020-09-30T04:15:05Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-2-field-values-and-exclude-matching-results-from/m-p/474487#M192481 <P>Below is my search output for the SPL i am running.</P> <P>`<BR /> <STRONG>db_1</STRONG><BR /><BR /> oracle_test<BR /><BR /> db2_bio<BR /><BR /> oracle_890<BR /><BR /> n88888<BR /><BR /> n7777 </P> <P><STRONG>server_2</STRONG><BR /><BR /> n87896<BR /> bg8768<BR /> j987653<BR /> n88888<BR /><BR /> n7777<CODE></CODE> </P> <P>How do i exclude the field records which are identical between 2 fields like in this case -- (n88888 &amp; n7777)</P> <P>I tried using there where clause /Search , but without any success ..</P> <P>SPL used to display fields records which are not identical ---</P> <P>|splunk command | where db_1 != server_2 ( Not wokring )</P> <P>|splunk Command | fields db_1,server_2 | search db_1 !=server_2 ( Not working )</P> <P>Any clue/help will be appreciated ?</P> Wed, 30 Sep 2020 04:15:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-2-field-values-and-exclude-matching-results-from/m-p/474487#M192481 promukh 2020-09-30T04:15:05Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-2-field-values-and-exclude-matching-results-from/m-p/474488#M192482 <P>what's field name, <CODE>n88888</CODE> &amp; <CODE>n7777</CODE>?<BR /> and</P> <PRE><CODE>oracle_test db2_bio oracle_890 n88888 n7777 n87896 bg8768 j987653 n88888 n7777 </CODE></PRE> <P>your result is this?</P> Wed, 19 Feb 2020 22:38:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-2-field-values-and-exclude-matching-results-from/m-p/474488#M192482 to4kawa 2020-02-19T22:38:08Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-2-field-values-and-exclude-matching-results-from/m-p/474489#M192483 <P>field names are -- source1.db_1 &amp; source1.server_2</P> Wed, 30 Sep 2020 04:15:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-2-field-values-and-exclude-matching-results-from/m-p/474489#M192483 promukh 2020-09-30T04:15:11Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-2-field-values-and-exclude-matching-results-from/m-p/474490#M192484 <P>yes ..correct .. i want to exclude the matching records from both fields</P> Wed, 19 Feb 2020 22:53:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-2-field-values-and-exclude-matching-results-from/m-p/474490#M192484 promukh 2020-02-19T22:53:00Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-2-field-values-and-exclude-matching-results-from/m-p/474491#M192485 <P>what's your query?<BR /> server and db is another<BR /> host?</P> Wed, 19 Feb 2020 23:22:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-2-field-values-and-exclude-matching-results-from/m-p/474491#M192485 to4kawa 2020-02-19T23:22:45Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-2-field-values-and-exclude-matching-results-from/m-p/474492#M192486 <P>db_1:<BR /> source1.db_1 n88888<BR /> source1.server_2 n7777</P> <P>server_2:<BR /> source1.db_1 n88888<BR /> source1.server_2 n7777<BR /> this 2 results is exclude. right?</P> Wed, 30 Sep 2020 04:17:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-2-field-values-and-exclude-matching-results-from/m-p/474492#M192486 to4kawa 2020-09-30T04:17:45Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-2-field-values-and-exclude-matching-results-from/m-p/474493#M192487 <P>yes want to exclude those 2 values in the final output</P> Wed, 19 Feb 2020 23:48:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-2-field-values-and-exclude-matching-results-from/m-p/474493#M192487 promukh 2020-02-19T23:48:05Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-2-field-values-and-exclude-matching-results-from/m-p/474494#M192488 <P>ok , I was able to resolve using a single quote around the field name along with a where clause.</P> <P>|splunk command | where 'db_1'!='server_2'</P> <P>Found the below input in the splunk documentation which helped ..</P> <P><A href="https://docs.splunk.com/Documentation/SplunkInvestigate/Current/SearchReference/WhereCommandOverview" target="_blank">https://docs.splunk.com/Documentation/SplunkInvestigate/Current/SearchReference/WhereCommandOverview</A></P> <P>where 'host-name'="buttercup" If the expression references a field name that contains characters other than a-z, A-Z, 0-9, or the underscore ( _ ) character, the field name must be surrounded by single quotation marks.</P> <P>Thank You</P> Wed, 30 Sep 2020 04:15:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-2-field-values-and-exclude-matching-results-from/m-p/474494#M192488 promukh 2020-09-30T04:15:14Z