topic Re: show result of if a field not contains another field in Splunk Search

How to show result of if a field not contains another field?

hoseineagle — Mon, 10 Apr 2023 16:56:16 GMT

Hi all,

I have two fields. I want a splunk query that not a field contains another field.

For example field1 is ::ffff:127.0.0.1 and the field2 is 127.0.0.1 , so I dont want to see the queries that field1 contains field2.

Thank you

Re: show result of if a field not contains another field

gcusello — Mon, 10 Apr 2023 10:15:22 GMT

Hi @hoseineagle,

could you share some sample of your logs?

Ciao.

Giuseppe

Re: How to show result of if a field not contains another field?

PickleRick — Mon, 10 Apr 2023 17:06:41 GMT

If you want a simple comparison between two fields in the same event you just need to do a where command. Like

<your_base_search> 
| where fielda!=fieldb

Be warned however that it works much slower than if you were looking for some specific field values since Splunk has to retrieve all results from your base search and then - event by event - parse out your fields and verify whether they fit your criteria or not. So you should be as specific as you can in your base search anyway to limit data Splunk needs to fetch from indexes.

EDIT: I see you don't want a simple equality comparison but a more complicated one. That's ok, you can use the "where" command with any expression that yields boolean results so you can use - for example - like() function.

Re: How to show result of if a field not contains another field?

somesoni2 — Mon, 10 Apr 2023 19:23:32 GMT

Try something like this (replace line one with your search)

| makeresults | eval field1="::ffff:127.0.0.1", field2="127.0.0.1" | where like(field1,"%".field2)

Re: How to show result of if a field not contains another field?

yuanliu — Tue, 11 Apr 2023 07:28:59 GMT

It looks like the OP wants the opposite. So

| where NOT like(field1,"%".field2)

Anyway, what you are asking seems quite domain-specific. So, this may not be the generalization your application calls for.