Hi Team,
I am trying to compare IP addresses but I am unable to find any logic that can do so with the below query:
index=index_name sourcetype="sourcetype2" (POSTEDID!=SYSTEM AND VERIFIERID!=SYSTEM)
| rename ENTRYID as Maker_User
| rename POSTEDID as Checker_User
| rename VERIFIERID as Verifier_User
| stats values(Maker_User) as maker, values(ENTRYTIME) as maker_time, values(Checker_User) as checker, values(POSTEDTIME) as checker_time, values(Verifier_User) as verifier, values(VERIFIERTIME) as verifier_time, values(AMOUNT) as amount by TRANSACTIONID
| eval USER_ID = lower(mvappend(maker,checkerverifier))
| mvexpand USER_ID
| join USER_ID type=outer
[ search index=index_name sourcetype="sourcetype1"
| eval USERID=lower(USERID)
| stats values(IP) as dev_ip by USERID]
| where isnotnull(verifier) AND amount>100000
The results I get with this are as below:
| TRANSACTIONID |
Maker |
Maker Time |
Checker |
Checker Time |
Verifier |
Verifier Time |
Amount |
USERID |
IP |
| 001 |
A |
10:00 |
A |
10:03 |
B |
10:05 |
200000 |
A |
IP of A |
| 001 |
A |
10:00 |
A |
10:03 |
B |
10:05 |
200000 |
A |
IP of A |
| 001 |
A |
10:00 |
A |
10:03 |
B |
10:05 |
200000 |
B |
IP of B |
I want to have a logic that can compare the IP address of A and the IP address of B so that both IP addresses are not the same.
Any assistance would be appreciated.
