topic Re: I wanted to search by comparing two String attibutes are unqual in Splunk Search

How to search by comparing two String attributes that are unequal?

akhil11 — Wed, 16 Feb 2022 22:04:43 GMT

Below is the usual Splunk Search line in addressVal is not equal to outAddressVal.

I tried below Search but it did not help

index= * addressVal outAddressVal| where (rtrim(ltrim('addressVal ')) != rtrim(ltrim('outAddressVal')))

Content line is like below

addressVal = WV ,outAddressVal= RA addressVal = CA,outAddressVal= RA addressVal = WV ,outAddressVal= RA addressVal = WV ,outAddressVal= RA

Re: I wanted to search by comparing two String attibutes are unqual

PickleRick — Wed, 16 Feb 2022 21:53:36 GMT

Are your fields addressVal and outAddressVal getting parsed out from the event? If they aren't your "where" won't work because you don't have anything to compare.

Re: I wanted to search by comparing two String attibutes are unqual

akhil11 — Wed, 16 Feb 2022 21:59:34 GMT

Thank you for your response. Yes - both the fields shows in the list of interested fields on left bottom side of splunk search

Re: I wanted to search by comparing two String attibutes are unqual

PickleRick — Thu, 17 Feb 2022 08:43:27 GMT

And you're sure your field names are properly cased?

Re: I wanted to search by comparing two String attibutes are unqual

isoutamo — Thu, 17 Feb 2022 12:24:59 GMT

It those field are from you events and you want to compare content of them (removing spaces and tab) then you can do it like this

| where trim(addressVal) != trim(outAddressVal)

If there are no spaces or tabs inside outer letters like " asdsda ". But if there are those inside string then you need to use your original without those ' over your fieldnames. If you are using it like 'addressVal ' then the fieldname is 'addressVal ' not 'addressVal'.

r. Ismo

Re: How to search by comparing two String attributes that are unequal?

yuanliu — Mon, 21 Feb 2022 21:08:33 GMT

I think the confusion comes from how field name is constructed during extraction; specifically, the first field name is most likely 'addressVal', not 'addressVal '. Therefore,

index= * addressVal outAddressVal| where (rtrim(ltrim('addressVal')) != rtrim(ltrim('outAddressVal')))

should work for your data.

Meanwhile, Splunk's key-value extraction ignores spaces surrounding equal sign ("="), as well as trailing blanks after the last consecutive non-space character in value. (Unless you use custom extraction algorithms.) This means that the values probably do not contain spaces, either. In other words,

index= * addressVal outAddressVal | where 'addressVal' != 'outAddressVal'

may suffice. But if you feel necessary to both ltrim() and rtrim(), @isoutamo's suggestion of trim() would be a better choice.