Below is my search output for the SPL i am running.
How do i exclude the field records which are identical between 2 fields like in this case -- (n88888 & n7777)
I tried using there where clause /Search , but without any success ..
SPL used to display fields records which are not identical ---
|splunk command | where db1 != server2 ( Not wokring )
|splunk Command | fields db1,server2 | search db1 !=server2 ( Not working )
Any clue/help will be appreciated ?
what's field name,
oracle_test db2_bio oracle_890 n88888 n7777 n87896 bg8768 j987653 n88888 n7777
your result is this?
this 2 results is exclude. right?
ok , I was able to resolve using a single quote around the field name along with a where clause.
|splunk command | where 'db1'!='server2'
Found the below input in the splunk documentation which helped ..
where 'host-name'="buttercup" If the expression references a field name that contains characters other than a-z, A-Z, 0-9, or the underscore ( _ ) character, the field name must be surrounded by single quotation marks.