Compare two fields and ignore the data with same values

[Meena27]

Hi,

I am trying to include a condition where splunk needs to ignore when it two different fields has the same values.

Any suggestions?

[Raghav2384 · Accepted solution]

Post your search if possible.

I would assume adding something like this at the end of your search

...|more search| where field1 != field2

That gives results where the two fields are not equal. Hope this helps.
Thanks,
Raghav

[bhagatdd]

@Raghav2384 

There is also one more condition. Final result must find common Plugin_ID between (earliest=-180d@d latest= -30d@d) and ((earliest=-35@d latest= now)