Hello all, brand new to Splunk so please bare with me.
I have two csv files as two different sources with the same type of data in each. It looks like the following:
I want to be able to compare the first value in Source1column1 "2000" and return how many instances "2000" is greater than all of the numbers in Source2column1. In this case it should return the value of 2. The end result should be a table showing Source1 data and a count of the instances. Then I'm assuming I can perform eval statements on the results from there..
Anyhow, in excel I can do this in 5 seconds using if statements and array formulas but I would like to implement the same functionality in Splunk and am just having a hard time getting started with the syntax of comparing two sources and their fields.. Any help is appreciated!