topic Re: Comparing fields of different events in the same log file in Splunk Search

Comparing fields of different events in the same log file

gaishi — Wed, 02 Mar 2022 01:40:51 GMT

Hello all,

I'd like to compare events in the same log files, amusing the format of the events are the same. For example:

event1: ccc, ddd

event2: bbb, ccc

event3: aaa, bbb

As you can see there's a pattern, the 2nd part (bbb) in event3 is always the same as the 1st part in event2, and the 2nd part in event 2 (ccc) is always the same as the 1st part in event 1.

My question is how do I check if all the events in the same log file match this pattern. Thank you in advance!

Sincerely,

Gai

Re: Comparing fields of different events in the same log file

gcusello — Wed, 02 Mar 2022 08:33:56 GMT

Hi @gaishi,

if you want to check the presence of a predefined pattern (e.g. "bbb"), you could run something like this:

index=your_index | eval check=if(searchmatch("bbb"),"yes","not") | table _time _raw check

If instead you want to check the patterns in your logs, there's a tab in the search dashboard.

Ciao.

Giuseppe

Re: Comparing fields of different events in the same log file

ITWhisperer — Wed, 02 Mar 2022 10:19:13 GMT

Assuming you have fields called field1 and field2, and your events are already in the order you want to compare.

| streamstats window=2 current=f values(field1) as previous_field1 | eval match2withprevious1=if(field2=previous_field1,"match","not match")