Comparing two different fields in separate events?

bhupi — Thu, 01 Dec 2022 16:37:28 GMT

Hi Splunkers

I am looking to get some help in spl for following use case

| makeresults count=4 | streamstats count | eval src=case(count=1, "2.3.5.6", count=2, "3.3.3.3", count=3, "1.1.1.6", count=4, "4.5.6.4") | eval dest = case(count=1, "4.5.6.4", count=2, "4.5.6.4", count=3, "2.2.2.6", count=4,"2.3.5.6")

I want to get only event1 and event4 . In this case event1 src=dest event4 and event1 dest=src event4. This is only a run anywhere example. In real there will be thousands of events and I want to compare event x src=dest event y

Thanks

Bhupi

Re: comparing two different fields in separate events

gcusello — Thu, 01 Dec 2022 08:45:20 GMT

Hi @bhupi,

I have some problem to figure your real need, anyway, you should define the rule to choose event x and event y and assign the src and dest values when these events occur, in other words you should<your_search> | eval check=case(event=x,"src",event=y,dest) | stats values(check) AS check dc(check) AS check_count BY key.

Ciao.

Giuseppe

topic Comparing two different fields in separate events? in Splunk Search

Comparing two different fields in separate events?

Re: comparing two different fields in separate events