Correlating field values and finding where they match

sasisudas — Tue, 29 Sep 2020 13:35:59 GMT

Hello guys,

So I have struggled writing search pipeline for this senario:

I have comparing unique id(numerical value) in 3 different fields (id_1,id_2,id_3). The data looks something like:
id_1 | id_2 | id_3
1 3 4
2 4 5
3 5 6
4 6 5
4 5 3

I want to find out where all three columns have a matching value.
For example, here 4 would be a unique value that appears in all three fields.

I am new to Splunk so please excuse my lack of knowledge on the different commands. But i feel like I might be missed a big concept in Splunk Search Language.

Advance thanks for any help on this.

-New Splunk Enthusiast

Re: Correlating field values and finding where they match

martin_mueller — Tue, 11 Apr 2017 07:48:38 GMT

This should do, starting from your initial table:

... | table id_1 id_2 id_3 | eval foo = 42 | untable foo name value | stats dc(name) as dc by value | where dc=3

That will distinct-count the field names per value, and only keep those values that occur in all three field names.

topic Correlating field values and finding where they match in Splunk Search

Correlating field values and finding where they match

Re: Correlating field values and finding where they match