Splunk Search

Comparing two different fields in separate events?

bhupi
New Member

Hi Splunkers

I am looking to get some help in spl for following use case

| makeresults count=4
| streamstats count
| eval src=case(count=1, "2.3.5.6", count=2, "3.3.3.3", count=3, "1.1.1.6", count=4, "4.5.6.4")
| eval dest = case(count=1, "4.5.6.4", count=2, "4.5.6.4", count=3, "2.2.2.6", count=4,"2.3.5.6")

I want to get only event1 and event4 . In this case event1 src=dest event4 and event1 dest=src event4. This is only a run anywhere example. In real there will be thousands of events and I want to compare event x src=dest event y

Thanks

Bhupi

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @bhupi,

I have some problem to figure your real need, anyway, you should define the rule to choose event x and event y and assign the src and dest values when these events occur, in other words you should<your_search> | eval check=case(event=x,"src",event=y,dest) | stats values(check) AS check dc(check) AS check_count BY key.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...