Splunk Search

Comparing two fields from different sources, eval and subsearch?

Splunk Employee
Splunk Employee

Hello all, brand new to Splunk so please bare with me.

I have two csv files as two different sources with the same type of data in each. It looks like the following:













I want to be able to compare the first value in Source1column1 "2000" and return how many instances "2000" is greater than all of the numbers in Source2column1. In this case it should return the value of 2. The end result should be a table showing Source1 data and a count of the instances. Then I'm assuming I can perform eval statements on the results from there..

Data Instances

2000 2

1000 0

4000 3

9000 4

Anyhow, in excel I can do this in 5 seconds using if statements and array formulas but I would like to implement the same functionality in Splunk and am just having a hard time getting started with the syntax of comparing two sources and their fields.. Any help is appreciated!

Splunk Employee
Splunk Employee

I wouldn't mind using a subsearch to start.. but i could use a good example to help get things going, anyone?

0 Karma


I think this might require subsearching, but I would be intrigued to see if someone can come up with a more elegant solution than subsearching.

0 Karma
Get Updates on the Splunk Community!

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...