Archive

compare two fields value for equality in two different indexes

New Member

HI
I want to know why this code is not working
index="malecious_url" OR index="surikata" |fields http2,http | where(http==http2)

I want to compare them and show which thing is similar in 2 fields that I created in 2 different indexes and sourcetypes

Tags (1)
0 Karma

SplunkTrust
SplunkTrust

== is equal. Similar is not the same statement. So, if the fields do not match exactly you will get no results. try a table http, http2 on the end and skim the results to see how they look compared to each other.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!