https://community.splunk.com/t5/Splunk-Search/compare-two-searches/m-p/117638#M31348 <P>Hey,<BR /> I want to compare the results of the first search to the second. Like loop through the second one with the first ones results </P> <P>Something like this,<BR /> Index=index1| eval val1=substr(value, 0,1) [search index=index2| eval val2=substr(value2, 2,1) | eval match=if(val1==val2, 1,0)]</P> <P>Thanks! </P> Tue, 24 Jun 2014 14:09:49 GMT zuzgon2 2014-06-24T14:09:49Z https://community.splunk.com/t5/Splunk-Search/compare-two-searches/m-p/117638#M31348 <P>Hey,<BR /> I want to compare the results of the first search to the second. Like loop through the second one with the first ones results </P> <P>Something like this,<BR /> Index=index1| eval val1=substr(value, 0,1) [search index=index2| eval val2=substr(value2, 2,1) | eval match=if(val1==val2, 1,0)]</P> <P>Thanks! </P> Tue, 24 Jun 2014 14:09:49 GMT https://community.splunk.com/t5/Splunk-Search/compare-two-searches/m-p/117638#M31348 zuzgon2 2014-06-24T14:09:49Z https://community.splunk.com/t5/Splunk-Search/compare-two-searches/m-p/117639#M31349 <P>Try this</P> <PRE><CODE>index=index1| eval val1=substr(value, 0,1) | eval joinfield=1 | join max=0 joinfield [search index=index2| eval val2=substr(value2, 2,1) | eval joinfield=1] | eval match=if(val1==val2, 1,0) </CODE></PRE> Tue, 24 Jun 2014 14:33:15 GMT https://community.splunk.com/t5/Splunk-Search/compare-two-searches/m-p/117639#M31349 somesoni2 2014-06-24T14:33:15Z