https://community.splunk.com/t5/Splunk-Search/How-to-compare-two-fields-with-every-value/m-p/565797#M197150 <P>Hi guys. I'm completly new to Splunk. Sorry if my question seems kinda stupid <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span><BR /><BR />I have some log-data including a GUID. Those are separated in two kinds: "error" and "times". Sometimes, an error-log has the same GUID as a times-log. I need to count those double GUIDs, for that reason I have to extract the GUIDs from their original field und compare them with each other.<BR /><BR />I managed to extract them with Regex into two new fields. But now I'm searching for an opportunity to compare every error-GUID with every times-GUID.<BR /><BR />Thanks for your help! <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Fri, 03 Sep 2021 13:25:32 GMT username13 2021-09-03T13:25:32Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-two-fields-with-every-value/m-p/565797#M197150 <P>Hi guys. I'm completly new to Splunk. Sorry if my question seems kinda stupid <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span><BR /><BR />I have some log-data including a GUID. Those are separated in two kinds: "error" and "times". Sometimes, an error-log has the same GUID as a times-log. I need to count those double GUIDs, for that reason I have to extract the GUIDs from their original field und compare them with each other.<BR /><BR />I managed to extract them with Regex into two new fields. But now I'm searching for an opportunity to compare every error-GUID with every times-GUID.<BR /><BR />Thanks for your help! <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Fri, 03 Sep 2021 13:25:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-two-fields-with-every-value/m-p/565797#M197150 username13 2021-09-03T13:25:32Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-two-fields-with-every-value/m-p/565823#M197155 <P>Are the two GUIDs in the same event or different events?&nbsp; If so, a simple <FONT face="courier new,courier">where</FONT> command should find the duplicates.</P><LI-CODE lang="markup">... | where errorGUID = timesGUID</LI-CODE><P>If they're in different events, then we'll need to create a common field so the <FONT face="courier new,courier">stats</FONT> command can group events.&nbsp; Then keep only the results where two events have the same GUID.</P><LI-CODE lang="markup">... | eval GUID=coalesce(errorGUID, timesGUID) | stats count, values(*) as * by GUID | where count=2</LI-CODE><P>&nbsp;</P> Fri, 03 Sep 2021 15:17:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-two-fields-with-every-value/m-p/565823#M197155 richgalloway 2021-09-03T15:17:42Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-two-fields-with-every-value/m-p/566006#M197226 <P>It worked. Thank you so much!</P> Mon, 06 Sep 2021 11:04:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-two-fields-with-every-value/m-p/566006#M197226 username13 2021-09-06T11:04:44Z