Archive

compare two fields value for equality in two different indexes

New Member

HI
I want to know why this code is not working
index="malecious_url" OR index="surikata" |fields http2,http | where(http==http2)

I want to compare them and show which thing is similar in 2 fields that I created in 2 different indexes and sourcetypes

Tags (1)
0 Karma

SplunkTrust
SplunkTrust

== is equal. Similar is not the same statement. So, if the fields do not match exactly you will get no results. try a table http, http2 on the end and skim the results to see how they look compared to each other.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!