Splunk Search

Compare two fields and ignore the data with same values

Meena27
Explorer

Hi,

I am trying to include a condition where splunk needs to ignore when it two different fields has the same values.

Any suggestions?

0 Karma
1 Solution

Raghav2384
Motivator

Post your search if possible.

I would assume adding something like this at the end of your search

...|more search| where field1 != field2

That gives results where the two fields are not equal. Hope this helps.
Thanks,
Raghav

View solution in original post

Raghav2384
Motivator

Post your search if possible.

I would assume adding something like this at the end of your search

...|more search| where field1 != field2

That gives results where the two fields are not equal. Hope this helps.
Thanks,
Raghav

bhagatdd
Explorer

@Raghav2384 

There is also one more condition. Final result must find common Plugin_ID between (earliest=-180d@d latest= -30d@d) and ((earliest=-35@d latest= now)

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...