topic Re: Difference between two fields in Splunk Search

Calculate the difference between two fields?

Abdullah — Sun, 05 Feb 2023 23:15:34 GMT

Dears,

We have two fields in the one index, we need to compare two fields then create a new field to show only on it the difference between two fields.

Below one of example from the results from two fields:

current_conf field:

_Name:REQ000004543448-4614240-shrepoint

previous_conf field:

_Name:REQ000004543448-shrepoint

Please your support.

Re: Difference between two fields

ITWhisperer — Sun, 05 Feb 2023 07:31:04 GMT

When you are referring to the difference between two strings, you should be more specific. For example, what would you expect to have been shown for your example?

Having said that, I suspect that it is non-trivial and not something that is supported out-of-the-box.

Re: Difference between two fields

Abdullah — Sun, 05 Feb 2023 07:46:05 GMT

Hi @ITWhisperer.

The results that I need from my example, create new field contain the deference between two fields that it is "4614240".

current_conf field:

_Name:REQ000004543448-4614240-shrepoint

previous_conf field:

_Name:REQ000004543448-shrepoint

Best Regards,

Re: Difference between two fields

ITWhisperer — Sun, 05 Feb 2023 08:07:57 GMT

Why not "4614240-" or "-4614240"?

What if your fields were "_Name:REQ000004543448-4614240-shrepoint" and "_Name:REQ000005543448-shrepoint"?

What about "_Name:REQ000004543448-4614240-shrepoint" and "_Name:REQ000004543448-4614240-shrepoint " (extra space at the end)?

What about " _Name:REQ000004543448-4614240-shrepoint" and "_Name:REQ000004543448-4614240-shrepoint" (extra space at the beginning)?

Re: Difference between two fields

Abdullah — Sun, 05 Feb 2023 08:16:58 GMT

Why not "4614240-" or "-4614240"?

No problem, we can show the field result with "-" in the begging or end, it is not big deal.

Regarding the others below questions, only need to show the deference between two fields.

Best Regards,

Re: Difference between two fields

ITWhisperer — Sun, 05 Feb 2023 08:30:27 GMT

It kind of is a big deal. The requirement is too vague and not fully described, or it can be taken as being very specific as in you only want it applied to those exact examples you have given. The second example looks like it has two differences (the 5 instead of 4, and the extra numbers), how would you like to show that? The leading space in the fourth example means that every character position is different between the two fields. The trailing space example is identical apart from the extra space in one of the fields, does this matter, or should it be stripped before the comparison?

We humans can "easily" recognise the differences between these strings, but teaching a machine to do this is non-trivial, especially with the limited capabilities available in Splunk. It is not a tool designed for detecting these sorts of differences.

Re: Difference between two fields

Abdullah — Sun, 05 Feb 2023 08:38:06 GMT

Hi,

current_conf field:

_Name:REQ000004543448-4614240-shrepoint

previous_conf field:

_Name:REQ000004543448-shrepoint

Yes I understood you, we just need to know the different number between two fields, that it is "4614240" without - end and beginning.

So can we do that or, it is not?

Re: Difference between two fields

ITWhisperer — Sun, 05 Feb 2023 08:43:22 GMT

It depends on what else is consistent between your fields - in your example, you could do this

| rex field=current_conf "\-(?<diff>\d+)\-"

to extract the extra digits.

Re: Difference between two fields

Abdullah — Sun, 05 Feb 2023 09:20:08 GMT

Ok Mr, after extract, what is the next step.

Re: Difference between two fields

ITWhisperer — Sun, 05 Feb 2023 09:27:13 GMT

That depends on what you are trying to achieve. The extract will give you a non-null value if the field matches the pattern, you you could filter on this

| where isnotnull(diff)

Re: Difference between two fields

Abdullah — Sun, 05 Feb 2023 09:53:20 GMT

Yes, then, please share with me the full search.

Thank you

Re: Difference between two fields

ITWhisperer — Sun, 05 Feb 2023 09:54:40 GMT

What do you have so far?

Re: Difference between two fields

Abdullah — Sun, 05 Feb 2023 11:48:40 GMT

Actually now I tried below search for find the deference between two fields that the results separated by "," not by "-", see the search and results for the fields below:

current_conf field:

_URL_Value:http://0wl0jql1h.energosberezhenie.com/*,http://post5.vkrugudruzei.ru,https://ath-365-folder-0utlook.web.appyuci7nr4cp63857abfc58f7.tukoapps.ruath-365-folder-0utlook.web.app,https://ath-365-folder-0utlook.web.appyuci7nr4cp63857abfc58f7.tukoapps.ruath-365-folder-0utlook.web.app/*,http://173.208.96.43/,http://survey-smiles.com,https://survey-smiles.com,https://spl-notofocation.tempurl.host/*,https://email.notify.thinkific.com/c/*,https://use.typekit.net/af/*,https://mandrillapp.com/track/click/30195602/*,https://soporte-chilos.tempurl.host/*,https://cloudflare.hcaptcha.com,http://cloudflare.hcaptcha.com,https://6pke47.codesandbox.io,http://6pke47.codesandbox.io,https://boofxvacpc63a506565edb7.segopet.ru,http://boofxvacpc63a506565edb7.segopet.ru,http://bitsnpieces.be/*,https://quickentrance.com/pokke/*,https://quickentrance.com/portalspl/*,https://portalspl.ddns.net/*,http://ww1.goofle.com/*,https://ww1.goofle.com/*,http://coupons.com/*,https://coupons.com/*,http://print.coupons.com/*,https://print.coupons.com/*,https://nrezirn.com,https://65r4prji.r.us-west-2.awstrack.me,http://mrkzgulfup.com,http://dlupload.com,http://hssonee.wap.sh4shared,http://top4top.io,http://imagesupload.org,http://www.jo1sat.net,http://up.djelfa.info,http://up.3raq4all.com,http://upload.chjoy.com,http://up-9.com,http://www.gulf-up.com,http://upload.hawamer.com,http://www.i2pdf.com,http://www.zamzar.com,http://www.duplichecker.com,http://theonlineconverter.com,http://www.foxit.com,http://www.id4arab.com,http://www.camscanner.com,http://www.pdf-suite.com,http://pdf.wondershare.com,http://png2pdf.com,http://pdf2png.com,http://www.pdfmate.com,http://www.web2pdfconvert.com,http://bitsnpieces.be/,https://chedid-insurance-shared-0utlook.firebaseapp.com/,https://chedid-insurance-shared-0utlook.firebaseapp.com,https://mxtkkh79df637a616f5d109.repstara.ru/id-63a40b311d9c3,https://mxtkkh79df637a616f5d109.repstara.ru,http://img6.wsimg.com,http://chedid-insurance-shared-0utlook.firebaseapp.com,http://mxtkkh79df637a616f5d109.repstara.ru,http://nesaih.co.za/*,https://tawangmang.ru/*,https://attach.mail.daum.net/bigfile/v1/urls/fd/_qloddhfj3pazipqgta7u0grwye/a3h7zdglhcstmgl0pq3q0q,https://attach.mail.daum.net/bigfile/v1/urls/d/_qloddhfj3pazipqgta7u0grwye/f3nwh6txiwi2v_hzvt74zw,https://t.ly/-r-b,http://r3.o.lencr.org/,https://linkunshorten.com/?url=https%3a%2f%2fvancouveredu.com%2fsecure%2f&sitenotsafe=true,https://vancouveredu.com/secure/&sitenotsafe=true,https://vancouveredu.com/secure/,http://196.224.96.4

previous_conf field:

Search query:

But the search is not work.

Please your support.