topic Re: Compare same field with values for equality in Splunk Search

How to compare same field with values for equality?

satish — Mon, 09 Jan 2023 16:30:40 GMT

Hi Experts,

I would like to compare values in same field (vlan_ids) for equality based on a machine serial (hyp_serial).

Would like validate whether the VLAN ID's are configured on both VM's under same hyp_serial are same or not equal.

There will be 2 VM's under the same serial.

Could you please help me with my requirement.

index=lab source=unix_hyp

| spath path=hyp_info{}{} output=LIST

| mvexpand LIST

| spath input=LIST

| where category == "hyp_vlan"

| table hyp_name hyp_serial vlan_ids

Table Output:

------------------

hyp_name hyp_serial vlan_ids

hyp_vm1 AE12893X 5_767_285_2010

hyp_vm2 AE12893X5_356_375_2010

hyp_vm3 ZX87627J9_49_43_44_3120

hyp_vm4 ZX87627J9_49_43_44_3120

hyp_vm5 YG92412K5_767_285_2010

hyp_vm6 YG92412K 5_767

Expected Output:

-----------------

hyp_name hyp_serial vlan_ids VLAN CHECK

hyp_vm1 AE12893X 5_767_285_2010 OK

hyp_vm2 AE12893X 5_356_375_2010 OK

hyp_vm3 ZX87627J 9_49_43_44_3120 OK

hyp_vm4 ZX87627J 9_49_43_44_3120 OK

hyp_vm5 YG92412K 5_767_285_2010 MISMATCH

hyp_vm6 YG92412K 5_767 MISMATCH

Re: Compare same field with values for equality

PaulPanther — Mon, 09 Jan 2023 10:57:07 GMT

Following search should do the trick

index=lab source=unix_hyp | spath path=hyp_info{}{} output=LIST | mvexpand LIST | spath input=LIST | where category == "hyp_vlan" | stats dc(hyp_name) as result by hyp_serial, vlan_ids | eval status=case(result=2, "OK", result<2, "MISMATCH") | fields - result

Re: Compare same field with values for equality

satish — Mon, 09 Jan 2023 11:42:44 GMT

@PaulPanther Could you advise if there is any way to validate the VLAN ID's

For the below one the mismatch value is due to missing VLAN 285 and 2010.. Is there any way to do the comparison in that way.

hyp_vm5 YG92412K 5_767_285_2010 MISMATCH

hyp_vm6 YG92412K 5_767 MISMATCH

Re: Compare same field with values for equality

PaulPanther — Mon, 09 Jan 2023 11:57:08 GMT

@satish If the VLAN_IDs are more or less static values you could work with lookups (About lookups - Splunk Documentation).

Execute following steps for it:

1. Create new empty lookup

2. Create a scheduled report to fill the lookup with valid VLAN_IDs based on your ingested data OR fill the lookup manually with values

3. Use the lookup within your search to get an overview about all VMs whose associated VLAN IDs are not valid

Re: Compare same field with values for equality

satish — Mon, 09 Jan 2023 11:59:51 GMT

@PaulPanther

Let me try using Lookup.. Thanks Paul.