Splunk Search

Comparing fields of different events in the same log file

gaishi
New Member

Hello all,

I'd like to compare events in the same log files, amusing the format of the events are the same. For example:

event1: ccc, ddd

event2: bbb, ccc

event3: aaa, bbb

As you can see there's a pattern, the 2nd part (bbb) in event3 is always the same as the 1st part in event2, and the 2nd part in event 2 (ccc) is always the same as the 1st part in event 1.

My question is how do I check if all the events in the same log file match this pattern. Thank you in advance!

Sincerely,

Gai

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming you have fields called field1 and field2, and your events are already in the order you want to compare.

| streamstats window=2 current=f values(field1) as previous_field1
| eval match2withprevious1=if(field2=previous_field1,"match","not match")

gcusello
SplunkTrust
SplunkTrust

Hi @gaishi,

if you want to check the presence of a predefined pattern (e.g. "bbb"), you could run something like this:

index=your_index
| eval check=if(searchmatch("bbb"),"yes","not")
| table _time _raw check

If instead you want to check the patterns in your logs, there's a tab in the search dashboard.

Ciao.

Giuseppe

 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...