Splunk Search

Compare two fields and ignore the data with same values

Meena27
Explorer

Hi,

I am trying to include a condition where splunk needs to ignore when it two different fields has the same values.

Any suggestions?

0 Karma
1 Solution

Raghav2384
Motivator

Post your search if possible.

I would assume adding something like this at the end of your search

...|more search| where field1 != field2

That gives results where the two fields are not equal. Hope this helps.
Thanks,
Raghav

View solution in original post

Raghav2384
Motivator

Post your search if possible.

I would assume adding something like this at the end of your search

...|more search| where field1 != field2

That gives results where the two fields are not equal. Hope this helps.
Thanks,
Raghav

bhagatdd
Explorer

@Raghav2384 

There is also one more condition. Final result must find common Plugin_ID between (earliest=-180d@d latest= -30d@d) and ((earliest=-35@d latest= now)

0 Karma
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...