Comparaing strings of different key

[aahadqj]

Hi,

I would like to build a query to compare the var1 and var2 and then determinecount.

Example lets say var1 = "abc" var1 = "cbd" var1 = "dfg"

var2 = "abc" var2 = "cbd" var2 = "z_dfg"

Output should be count matches, mismatches and count of var1 over a period of time.

we need to determine the count of all the matches and mismatches

Abdul Ahad

[David]

I would probably put this into a dashboard so you could run the following search:

YourSearch | eval Match=if(var1=var2,"Match","No Match")

And then do post processing for the number of matches and mismatches:

| timechart count by Match

and for the variations of Var1:

| timechart distinct_count(var1)

I was trying to find a way to put it all into one search, but couldn't see an easy way to allow it to chart over time. For a one time result, you could use the following:

YourSearch | eval Match=if(var1=var2,"Match","No Match") 
           | eventstats distinct_count(var1) as Var1Count 
           | stats count, first(Var1Count) by Match

It's a bit hokey, though. Perhaps someone will take it the rest of the way.