How to compare more that 50 column values for a specific row and so on for the next row in splunk?

[abhi04]

How to compare more than 50 column values for a specific row and so on for the next row in splunk?

I have below columns:

Parameter Server1 Server2 Server3 ...........................................................Server N
A .................. 2...............2...........2........................................................................2
B ....................2..............3...........3.........................................................................2
C
.
.
.
.
N

I want to compare values of each Parameter say for Parameter 'A' for different server and then display message "same" "not same" on the added column "Message" if any of the server value for that Parameter i.e. A is different .

[somesoni2]

Try like this (assuming your server names follow a pattern, say Server*)

your current search giving above output
| eval Message="NOT SET"
| foreach Server* [| eval Message=case(Message="NOT SET",'<<FIELD>>' , Message!='<<FIELD>>',"Not Same", true(),"Same")]

[abhi04]

@FrankVI @somesoni2
Currently, this is the query that I am using to extract the fields

index="auto_prod_cm_comparisions" sourcetype="auto_prod_details_log" source="/logs/web/output/smartauction2.0/" "/apps/web/sfw/java/" OR "Oracle Solaris" | rex field=_raw "(?:[^/\n]/){5}(?P\w+)"
| rex field=raw "Oracle(?.+)" | eval server=mvindex(split(source,"/"),4) |rex field=source "(\d+){2}(?.\w\d)_" |rex field=_raw "(?:[^=\n]=){6}/\w+/\w+/\w+/\w+/\w+-(?P[^/]+)"
|search NOT Server_Name=wb

And I want it in the above format mentioned where "Parameter" are Java_Version,Solaris_Version and Weblogic. Also I have list of below servers:

CAP1_dfw1svpap660,CAP1_dfw1svpap661,CAP1_dfw1svpap662,CAP1_sat1svmap660,CAP1_sat1svmap661,CAP1_sat1svmap662,CAP1_sat1svmap663,CAP1_sat1svmap664,CAP1_sat1svmap665,CAP1_sat1svmap666,
CAP1_sat1svmap667,CAP1_sat1svmap668,PRD1_dfw1svpap660,PRD1_dfw1svpap661,PRD1_dfw1svpap662,PRD1_sat1svmap660,PRD1_sat1svmap661,PRD1_sat1svmap662,PRD1_sat1svmap663,PRD1_sat1svmap664,
PRD1_sat1svmap665,PRD1_sat1svmap666,PRD1_sat1svmap667,PRD1_sat1svmap668,PSP1_dfw1svpap660,PSP1_dfw1svpap661,PSP1_dfw1svpap662,PSP1_sat1svmap660,PSP1_sat1svmap661,PSP1_sat1svmap662,
PSP1_sat1svmap663,PSP1_sat1svmap664,PSP1_sat1svmap665,PSP1_sat1svmap666,PSP1_sat1svmap667,PSP1_sat1svmap668,UAT1_dfw1svpap660,UAT1_dfw1svpap661,UAT1_dfw1svpap662,UAT1_sat1svmap660,
UAT1_sat1svmap661,UAT1_sat1svmap662,UAT1_sat1svmap663,UAT1_sat1svmap664,UAT1_sat1svmap665,UAT1_sat1svmap666,UAT1_sat1svmap667,UAT1_sat1svmap668

[abhi04]

@FrankVI, it only gives message as "same" even when values are different. Below is the query used.

foreach svpap
[| eval Message=case(Message="NOT SAME",'<>' , Message!='<>',"Not Same", true(),"Same")| eval Message = if(Message!="Not Same", "Same", Message)]|chart values(Message) over Parameter by Server_Name

[abhi04]

@FrankVI and @somesoni2 I have updated the question.

Please help me on the same.

[FrankVl]

Think you want to use Message instead of "Same" in the true() case, otherwise, "Same" will not match the value of further columns and trigger the Message!='<<FIELD>>' case, right? And then add a final | eval Message = if(Message!="Not Same", "Same", Message)?