topic Compare 2 fields in Splunk Search

Compare 2 fields

mcafeesecure — Tue, 29 Jun 2010 05:05:33 GMT

Basically I have a line of data that looks like this:

Jun 28 14:15:10 sc4-app04.mcafeesecure.com portal: ACCESS Click Referrer[bluecigs.com][http://www.blucigs.com/privacy-policy]

I have rex set up to extract two parts of this:

rex "(?i) Referrer\\[(?P<REF1>[^\\]]*)(?=\\])" | rex "(?i)www\.(?P<REF2>[^/]*)(?=/)"

This will basically give me 2 fields I can search on REF1 and REF2.

I would like only messages that do NOT have those two fields matching to show up for instance, in the previous entry I get

REF1=bluecigs.com
REF2=bluecigs.com

the following line I would have them NOT matching:

Jun 28 14:15:10 sc4-app04.mcafeesecure.com portal: ACCESS Click Referrer[bluecigs.com][http://www.SOMEOTHERDOMAIN.com/]

IE: REF1=bluecigs.com
REF2=SOMEOTHERDOMAIN.com

Is there a way to compare the fields?

bfaber — Tue, 29 Jun 2010 06:34:58 GMT

I would imagine you could add this to the end of your search

| search NOT REF1=REF2

but that may also give you events where REF1 and REF2 don't exist.

Try it out and let us know!

ziegfried — Tue, 29 Jun 2010 17:07:27 GMT

You can do this by using the where command:

<your search> | where REF1!=REF2

ziegfried — Tue, 29 Jun 2010 17:09:24 GMT

This won't work. It would compare the value of the field REF1 with the value "REF2" (ie. not the value of field REF2).