Splunk Search

Compare two fields and ignore the data with same values

Meena27
Explorer

Hi,

I am trying to include a condition where splunk needs to ignore when it two different fields has the same values.

Any suggestions?

0 Karma
1 Solution

Raghav2384
Motivator

Post your search if possible.

I would assume adding something like this at the end of your search

...|more search| where field1 != field2

That gives results where the two fields are not equal. Hope this helps.
Thanks,
Raghav

View solution in original post

Raghav2384
Motivator

Post your search if possible.

I would assume adding something like this at the end of your search

...|more search| where field1 != field2

That gives results where the two fields are not equal. Hope this helps.
Thanks,
Raghav

bhagatdd
Explorer

@Raghav2384 

There is also one more condition. Final result must find common Plugin_ID between (earliest=-180d@d latest= -30d@d) and ((earliest=-35@d latest= now)

0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcment

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...