topic Re: Search to compare fields where field1 has both entries in field2? in Splunk Search

Search to compare fields where field1 has both entries in field2?

karthik4455 — Tue, 22 Jul 2014 13:13:47 GMT

I wish to run a query where I need to see if field1 has both entries in field2. Ex: I need to query the results like A & E which has both Escalated and Closed status.

Field status
A Escalated
A Closed
B Closed
C Escalated
D Escalated
E Escalated
E Closed

Re: Search to compare fields where field1 has both entries in field2?

somesoni2 — Tue, 22 Jul 2014 13:17:59 GMT

Try this

your base search giving fields 'Field' and 'status' | eventstats  count(status) as statusCount by Field | where statusCount > 1

Update

Give this a try

 your base search giving fields 'Field' and 'status' | stats values(status) as status by Field delim=" & " | where mvcount(status) > 1 | nomv status

Re: Search to compare fields where field1 has both entries in field2?

karthik4455 — Tue, 22 Jul 2014 13:31:55 GMT

Can you tell me how I can filter the output as follows:
You could notice the output doesn't have B,C & D because they should be dropped.

A Escalated & Closed
E Escalated & Closed

Re: Search to compare fields where field1 has both entries in field2?

somesoni2 — Tue, 22 Jul 2014 14:16:45 GMT

Try the updated answer.

Re: Search to compare fields where field1 has both entries in field2?

karthik4455 — Wed, 23 Jul 2014 09:15:46 GMT

Thanks a lot. It worked.