Re: Compare several fields from 2 indexes - Splunk Community

Splunk Search

I have two indexes: INDEX1 and INDEX2. In these indexes have the same fields: FIELD1, FIELD2, FIELD3 but they can have different values.

For example:
INDEX1: FIELD1=5, FIELD2=8
INDEX1: FIELD1=5, FIELD2=7

I need to get a table where will be show only fields with different values in different indexes. According the previous example:

|INDEX1|FIELD2=8|
|INDEX2|FIELD2=7|
or something similar

Which field or fields is/are used to join the two indexes so that a comparison between the other fields in the event can be sensibly made?

forget to add these fields in question. I use field @"TIMEIN"

see the answer here for hints

Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...