Archive
Highlighted

How to compare 2 field values and exclude matching results from the final output / count

Engager

Below is my search output for the SPL i am running.

`
db_1

oracletest

db2
bio

oracle_890

n88888

n7777

server_2

n87896
bg8768
j987653
n88888

n7777

How do i exclude the field records which are identical between 2 fields like in this case -- (n88888 & n7777)

I tried using there where clause /Search , but without any success ..

SPL used to display fields records which are not identical ---

|splunk command | where db1 != server2 ( Not wokring )

|splunk Command | fields db1,server2 | search db1 !=server2 ( Not working )

Any clue/help will be appreciated ?

0 Karma
Highlighted

Re: How to compare 2 field values and exclude matching results from the final output / count

Ultra Champion

what's field name, n88888 & n7777?
and

oracle_test db2_bio oracle_890 n88888 n7777
n87896 bg8768 j987653 n88888 n7777

your result is this?

0 Karma
Highlighted

Re: How to compare 2 field values and exclude matching results from the final output / count

Engager

field names are -- source1.db1 & source1.server2

0 Karma
Highlighted

Re: How to compare 2 field values and exclude matching results from the final output / count

Engager

yes ..correct .. i want to exclude the matching records from both fields

0 Karma
Highlighted

Re: How to compare 2 field values and exclude matching results from the final output / count

Ultra Champion

what's your query?
server and db is another
host?

0 Karma
Highlighted

Re: How to compare 2 field values and exclude matching results from the final output / count

Ultra Champion

db1:
source1.db
1 n88888
source1.server_2 n7777

server2:
source1.db
1 n88888
source1.server_2 n7777
this 2 results is exclude. right?

0 Karma
Highlighted

Re: How to compare 2 field values and exclude matching results from the final output / count

Engager

yes want to exclude those 2 values in the final output

0 Karma
Highlighted

Re: How to compare 2 field values and exclude matching results from the final output / count

Engager

ok , I was able to resolve using a single quote around the field name along with a where clause.

|splunk command | where 'db1'!='server2'

Found the below input in the splunk documentation which helped ..

https://docs.splunk.com/Documentation/SplunkInvestigate/Current/SearchReference/WhereCommandOverview

where 'host-name'="buttercup" If the expression references a field name that contains characters other than a-z, A-Z, 0-9, or the underscore ( _ ) character, the field name must be surrounded by single quotation marks.

Thank You

0 Karma