Hello,
I can't find out how to do a search to compare the same value in 2 fields, and if this is same value, add a third field.
For exemple:
index1 with field1Index1
and field2Index1
index2 with field1Index2
In the search, if field1Index1
= field1Index2
then display field1Index1
and field2Index1
NB: field1Index1
associated to field2Index1
in index1
I found different subjects on the forum with eval, if... but not with all that conditions.
Can you help me?
Thank you.
Can you try this ?
This will return results only if field1Index1=field1Index2
| makeresults
| eval field1Index1= 4
| eval field2Index1= 7
| eval field1Index2= 4
| eval field1Index1New =case(field1Index1=field1Index2,field1Index1,field1Index2=field1Index1,field2Index1,1=0,0)
| where field1Index1New!=""
| table field2Index1 field1Index1New
Ok but i don't need to set values 4 or 7.
I need to use values of search.
Thank you.
yeah, all you have to use is
index=index1 OR index=index2
| eval field1Index1New =case(field1Index1=field1Index2,field1Index1,field1Index2=field1Index1,field2Index1,1=0,0)
| where field1Index1New!=""
| table field2Index1 field1Index1New