Getting Data In

Compare values from same field in different events to all other events?

sg2
Engager


So I'm trying to get all events where val1+val2 are also in another event from the table. In the example below, I would need as output row 0 and row 1, because both val1 and val2 match.  Row 3 and 4 match on val1 but not on val2, and row 1 and 2 match on val2 but not on val1, so those events should get excluded. (Also I need time column to stay as I need to do some other operations with it)

 

row# time val1 val2
0 YYYY-MM-DD A X
1 YYYY-MM-DD A X
2 YYYY-MM-DD B X
3 YYYY-MM-DD C Y
4 YYYY-MM-DD C X
5 YYYY-MM-DD A Z

 

To solve this I've been trying:

 

 

 

 

| foreach val1
       [eval test=if(val1+val2=val1+val2, "same", "not")] 

 

 

 

 

or

 

 

 

 

'<<FIELD>>' = '<<FIELD>>'

 

 

 

 

But I end up getting with either "not" in all cases,  or "same" in others even tho both values are not actually the same

Labels (2)
Tags (2)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

FYI: foreach command only looks at fields in the SAME event, not across events. As @richgalloway says, use eventstats to calculate count as needed - that command will leave the original events untouched, so you have access to all fields still.

 

richgalloway
SplunkTrust
SplunkTrust

See if this helps

| eventstats count by val1 val2
| where count > 1
| fields - count

The eventstats command counts the number of rows with the same values for val1 and val2.  Then we eliminate the rows with a count of 1 and discard the count field.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...