Deployment Architecture

How to determine if it matches the value of another field?

Uryy
Engager

I want to keep it in field A (or any other field) only if there is a matching column in field A and field B, as shown in the figure below. It seems good to use the "foreach" statement, but I don't know how to implement it.

NoField AField B
1100 
2200 
3300 
4 100
5 4000
6 5000

 

Extract only the No. 1 column.

NoField AField B
1100 
Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi please try something like this:

your_search
| eval no_field1=no, field_merged=coalesce(field1, field2)
| stats values(no_field1) AS no values(field1) AS field1 count BY field_merged
| where count>1
| table no field1

Ciao.

Giuseppe

Get Updates on the Splunk Community!

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...

UCC Framework: Discover Developer Toolkit for Building Technology Add-ons

The Next-Gen Toolkit for Splunk Technology Add-on Development The Universal Configuration Console (UCC) ...

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...