Deployment Architecture

How to determine if it matches the value of another field?

Uryy
Engager

I want to keep it in field A (or any other field) only if there is a matching column in field A and field B, as shown in the figure below. It seems good to use the "foreach" statement, but I don't know how to implement it.

NoField AField B
1100 
2200 
3300 
4 100
5 4000
6 5000

 

Extract only the No. 1 column.

NoField AField B
1100 
Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi please try something like this:

your_search
| eval no_field1=no, field_merged=coalesce(field1, field2)
| stats values(no_field1) AS no values(field1) AS field1 count BY field_merged
| where count>1
| table no field1

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...