Splunk Search

Comparing two different fields in separate events?

New Member

Hi Splunkers

I am looking to get some help in spl for following use case

| makeresults count=4
| streamstats count
| eval src=case(count=1, "", count=2, "", count=3, "", count=4, "")
| eval dest = case(count=1, "", count=2, "", count=3, "", count=4,"")

I want to get only event1 and event4 . In this case event1 src=dest event4 and event1 dest=src event4. This is only a run anywhere example. In real there will be thousands of events and I want to compare event x src=dest event y



Labels (3)
0 Karma

Esteemed Legend

Hi @bhupi,

I have some problem to figure your real need, anyway, you should define the rule to choose event x and event y and assign the src and dest values when these events occur, in other words you should<your_search> | eval check=case(event=x,"src",event=y,dest) | stats values(check) AS check dc(check) AS check_count BY key.



0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...