Getting Data In

How to compare values in 2 fields and column that show Success/Failure?

shreyasathavale
Communicator

I have 2 fields as below

Field1    Field2
abc          abc
def          jkl
ghi          wxy
jkl
pqr
wxy

I have to compare values in Field1 with all values in Field2 and return "Success" if both are same and "Fail" if both are not same.

Expected Result:

Field1    Field2     Result
abc          abc         Success
def          jkl            Fail
ghi          wxy          Fail
jkl                             Success
pqr                          Fail
wxy                          Success

Index is same with different sourcetypes

0 Karma
1 Solution

HiroshiSatoh
Champion

Try this!

(your search)|table Field1,Field2|eval Result="Fail"
| join type=left Field1 [search (your search) Field2=*|table Field2
       |rename Field2 as Field1|eval Result="Success"]

View solution in original post

0 Karma

skoelpin
SplunkTrust
SplunkTrust

This assumes you passed a transformational command like stats to get that table view of your metrics. If so, just append this on and make sure to replace Field1 and Field2 with your column names

| eval Result=if(Field1==Field2,"Success","Fail")
0 Karma

HiroshiSatoh
Champion

Try this!

(your search)|table Field1,Field2|eval Result="Fail"
| join type=left Field1 [search (your search) Field2=*|table Field2
       |rename Field2 as Field1|eval Result="Success"]
0 Karma

shreyasathavale
Communicator

Thanks @HiroshiSatoh , I tried this and it is working as expected!!!

0 Karma
Get Updates on the Splunk Community!

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Admin Console: A Single, Unified Interface for All Your Cloud Admin Needs

WATCH NOWJoin us to learn how the admin console can save you time and give you more control over the Splunk® ...