https://community.splunk.com/t5/Splunk-Search/Compare-field-value-from-different-sourcetypes-to-list-the-value/m-p/475437#M192560 <P>There probably are a few ways to do that. Here's one.</P> <PRE><CODE>sourcetype=sourcetype1 OR sourcetype=sourcetype2 | stats values(Field2) by Field1 </CODE></PRE> Mon, 06 Jan 2020 13:45:08 GMT richgalloway 2020-01-06T13:45:08Z https://community.splunk.com/t5/Splunk-Search/Compare-field-value-from-different-sourcetypes-to-list-the-value/m-p/475436#M192559 <P>Hi All,<BR /> i have 2 files indexed as 2 different source types.<BR /> In Sourcetype1 i created:<BR /> 1. Field1 presents the value of a file let's say <STRONG>example.txt</STRONG><BR /> 2. Field2 presents the value of the result let's say <STRONG>[OK]</STRONG></P> <P>In Sourcetype2 i created:<BR /> Field1 presents the value of a file let's say <STRONG>example.txt</STRONG></P> <P>I would like to create a search that<BR /> <STRONG>If Field1 value from sourcetype1 = Field1 value from sourcetype2 list Field2 value from sourcetype1</STRONG></P> <P>My final goal is to create a table that lists the event details (time, user, files, results) the last column will be the result that is a little bit more trickier to achieve.</P> <P>Thanks A Lot Guys!</P> Mon, 06 Jan 2020 12:13:51 GMT https://community.splunk.com/t5/Splunk-Search/Compare-field-value-from-different-sourcetypes-to-list-the-value/m-p/475436#M192559 mardix86 2020-01-06T12:13:51Z https://community.splunk.com/t5/Splunk-Search/Compare-field-value-from-different-sourcetypes-to-list-the-value/m-p/475437#M192560 <P>There probably are a few ways to do that. Here's one.</P> <PRE><CODE>sourcetype=sourcetype1 OR sourcetype=sourcetype2 | stats values(Field2) by Field1 </CODE></PRE> Mon, 06 Jan 2020 13:45:08 GMT https://community.splunk.com/t5/Splunk-Search/Compare-field-value-from-different-sourcetypes-to-list-the-value/m-p/475437#M192560 richgalloway 2020-01-06T13:45:08Z