So I have struggled writing search pipeline for this senario:
I have comparing unique id(numerical value) in 3 different fields (id1,id2,id3). The data looks something like:
id1 | id2 | id3
1 3 4
2 4 5
3 5 6
4 6 5
4 5 3
I want to find out where all three columns have a matching value.
For example, here 4 would be a unique value that appears in all three fields.
I have run different seaches:
...|table id1.id2,id3|where id1==id2==id3
...|eval matchname=id2|where id1==matchname <-tried with 2 fields first, no result
...|table id1, id2|eval matchname=if(id1==id2,"y","n")
...|stats values(id1) by id2,id_3
I am new to Splunk so please excuse my lack of knowledge on the different commands. But i feel like I might be missed a big concept in Splunk Search Language.