Splunk Search

Comparing fields of different events in the same log file

gaishi
New Member

Hello all,

I'd like to compare events in the same log files, amusing the format of the events are the same. For example:

event1: ccc, ddd

event2: bbb, ccc

event3: aaa, bbb

As you can see there's a pattern, the 2nd part (bbb) in event3 is always the same as the 1st part in event2, and the 2nd part in event 2 (ccc) is always the same as the 1st part in event 1.

My question is how do I check if all the events in the same log file match this pattern. Thank you in advance!

Sincerely,

Gai

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming you have fields called field1 and field2, and your events are already in the order you want to compare.

| streamstats window=2 current=f values(field1) as previous_field1
| eval match2withprevious1=if(field2=previous_field1,"match","not match")

gcusello
SplunkTrust
SplunkTrust

Hi @gaishi,

if you want to check the presence of a predefined pattern (e.g. "bbb"), you could run something like this:

index=your_index
| eval check=if(searchmatch("bbb"),"yes","not")
| table _time _raw check

If instead you want to check the patterns in your logs, there's a tab in the search dashboard.

Ciao.

Giuseppe

 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...