Comparing two fields from different sources, eval and subsearch?

[Moogz]

Hello all, brand new to Splunk so please bare with me.

I have two csv files as two different sources with the same type of data in each. It looks like the following:

Source1column1

2000

1000

4000

9000

...

Source2column1

1400

1300

3000

8000

...

I want to be able to compare the first value in Source1column1 "2000" and return how many instances "2000" is greater than all of the numbers in Source2column1. In this case it should return the value of 2. The end result should be a table showing Source1 data and a count of the instances. Then I'm assuming I can perform eval statements on the results from there..

Data Instances

2000 2

1000 0

4000 3

9000 4

Anyhow, in excel I can do this in 5 seconds using if statements and array formulas but I would like to implement the same functionality in Splunk and am just having a hard time getting started with the syntax of comparing two sources and their fields.. Any help is appreciated!

[Moogz]

I wouldn't mind using a subsearch to start.. but i could use a good example to help get things going, anyone?

[nate015]

I think this might require subsearching, but I would be intrigued to see if someone can come up with a more elegant solution than subsearching.