Comparing two different fields in separate events?

[bhupi]

Hi Splunkers

I am looking to get some help in spl for following use case

| makeresults count=4
| streamstats count
| eval src=case(count=1, "2.3.5.6", count=2, "3.3.3.3", count=3, "1.1.1.6", count=4, "4.5.6.4")
| eval dest = case(count=1, "4.5.6.4", count=2, "4.5.6.4", count=3, "2.2.2.6", count=4,"2.3.5.6")

I want to get only event1 and event4 . In this case event1 src=dest event4 and event1 dest=src event4. This is only a run anywhere example. In real there will be thousands of events and I want to compare event x src=dest event y

Thanks

Bhupi

[gcusello]

Hi @bhupi,

I have some problem to figure your real need, anyway, you should define the rule to choose event x and event y and assign the src and dest values when these events occur, in other words you should<your_search> | eval check=case(event=x,"src",event=y,dest) | stats values(check) AS check dc(check) AS check_count BY key.

Ciao.

Giuseppe