Hi Splunker
I'm quite new to splunk. Can you please help me out on this search?
I have a table of antivirus database version of each servers.
Server | database version
A 5
B 4
C 4
D 3
E 5
Assume that A is my main server and the rest download from A. So I wanna compare the rest database version with A and display only the servers that version is less than A
so the expected result will be
Server | database version
B 4
C 4
D 3
Try some thing like this.
YOUR_SEARCH
| eventstats max(eval(if(Server=="A",database_version,null()))) as A_database_version
| where database_version< A_database_version | fields - A_database_version
My Sample Search :
| makeresults | eval _raw="Server,database_version
A,5
B,4
C,4
D,3
E,5"| multikv forceheader=1
| table Server,database_version
| rename comment as "Upto Now is sample data only"
| eventstats max(eval(if(Server=="A",database_version,null()))) as A_database_version
| where database_version< A_database_version | fields - A_database_version
Thanks
KV
▄︻̷̿┻̿═━一 ?
If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.
Hi Kamlesh
Thank your very much for your help!
Try some thing like this.
YOUR_SEARCH
| eventstats max(eval(if(Server=="A",database_version,null()))) as A_database_version
| where database_version< A_database_version | fields - A_database_version
My Sample Search :
| makeresults | eval _raw="Server,database_version
A,5
B,4
C,4
D,3
E,5"| multikv forceheader=1
| table Server,database_version
| rename comment as "Upto Now is sample data only"
| eventstats max(eval(if(Server=="A",database_version,null()))) as A_database_version
| where database_version< A_database_version | fields - A_database_version
Thanks
KV
▄︻̷̿┻̿═━一 ?
If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.