https://community.splunk.com/t5/Splunk-Search/Comparing-two-fields-from-different-sources-eval-and-subsearch/m-p/39445#M9002 <P>Hello all, brand new to Splunk so please bare with me.</P> <P>I have two csv files as two different sources with the same type of data in each. It looks like the following:</P> <P>Source1column1<BR /><BR /> 2000<BR /><BR /> 1000<BR /><BR /> 4000<BR /><BR /> 9000<BR /><BR /> ...</P> <P>Source2column1<BR /><BR /> 1400<BR /><BR /> 1300<BR /><BR /> 3000<BR /><BR /> 8000<BR /><BR /> ... </P> <P>I want to be able to compare the first value in Source1column1 "2000" and return how many instances "2000" is greater than all of the numbers in Source2column1. In this case it should return the value of 2. The end result should be a table showing Source1 data and a count of the instances. Then I'm assuming I can perform eval statements on the results from there..</P> <P>Data Instances<BR /><BR /> 2000 2<BR /><BR /> 1000 0<BR /><BR /> 4000 3<BR /><BR /> 9000 4 </P> <P>Anyhow, in excel I can do this in 5 seconds using if statements and array formulas but I would like to implement the same functionality in Splunk and am just having a hard time getting started with the syntax of comparing two sources and their fields.. Any help is appreciated!</P> Thu, 22 Dec 2011 14:38:02 GMT Moogz 2011-12-22T14:38:02Z https://community.splunk.com/t5/Splunk-Search/Comparing-two-fields-from-different-sources-eval-and-subsearch/m-p/39445#M9002 <P>Hello all, brand new to Splunk so please bare with me.</P> <P>I have two csv files as two different sources with the same type of data in each. It looks like the following:</P> <P>Source1column1<BR /><BR /> 2000<BR /><BR /> 1000<BR /><BR /> 4000<BR /><BR /> 9000<BR /><BR /> ...</P> <P>Source2column1<BR /><BR /> 1400<BR /><BR /> 1300<BR /><BR /> 3000<BR /><BR /> 8000<BR /><BR /> ... </P> <P>I want to be able to compare the first value in Source1column1 "2000" and return how many instances "2000" is greater than all of the numbers in Source2column1. In this case it should return the value of 2. The end result should be a table showing Source1 data and a count of the instances. Then I'm assuming I can perform eval statements on the results from there..</P> <P>Data Instances<BR /><BR /> 2000 2<BR /><BR /> 1000 0<BR /><BR /> 4000 3<BR /><BR /> 9000 4 </P> <P>Anyhow, in excel I can do this in 5 seconds using if statements and array formulas but I would like to implement the same functionality in Splunk and am just having a hard time getting started with the syntax of comparing two sources and their fields.. Any help is appreciated!</P> Thu, 22 Dec 2011 14:38:02 GMT https://community.splunk.com/t5/Splunk-Search/Comparing-two-fields-from-different-sources-eval-and-subsearch/m-p/39445#M9002 Moogz 2011-12-22T14:38:02Z https://community.splunk.com/t5/Splunk-Search/Comparing-two-fields-from-different-sources-eval-and-subsearch/m-p/39446#M9003 <P>I think this might require subsearching, but I would be intrigued to see if someone can come up with a more elegant solution than subsearching.</P> Sun, 08 Jan 2012 17:28:33 GMT https://community.splunk.com/t5/Splunk-Search/Comparing-two-fields-from-different-sources-eval-and-subsearch/m-p/39446#M9003 nate015 2012-01-08T17:28:33Z https://community.splunk.com/t5/Splunk-Search/Comparing-two-fields-from-different-sources-eval-and-subsearch/m-p/39447#M9004 <P>I wouldn't mind using a subsearch to start.. but i could use a good example to help get things going, anyone?</P> Tue, 17 Jan 2012 20:14:41 GMT https://community.splunk.com/t5/Splunk-Search/Comparing-two-fields-from-different-sources-eval-and-subsearch/m-p/39447#M9004 Moogz 2012-01-17T20:14:41Z