Comparing two values

[lemikg]

Hi everybody,

I am trying to compare two values which would be the network interfaces (MAC, em1, em2) and depending on the result I want to output true or false. Up until now I only came up with a workaround.

But I am sure there is a prettier and a more efficient way for what I intend to do.

sourcetype=interfaces 

| multikv | table host Name MAC em1 inetAddr inet6Addr RXbytes TXbytes Speed Duplex 

| eval bonded = if(em1 == MAC, "YES", "NO") 

| table host Name MAC inetAddr inet6Addr RXbytes TXbytes Speed Duplex bonded

Hopefully somebody can point me at the right direction.

Thanks in advance any help would be much appreciated.

Best regards from Germany

Mike

[martin_mueller · Accepted solution]

I'm not sure what you want to do differently, in order to compare two fields and produce "YES" or "NO" you won't get around comparing them and listing "YES" and "NO" in the branches.

You should however be able to ditch the first table command.

PS: If you need German support I'm sure we can work something out 🙂

[lemikg]

Hi Martin,
thanks for your reply. That is exactly what I was aiming for.
Regards,
Mike
PS: Danke für den Hinweis bzgl. des Supports.