Splunk Search

Correlating field values and finding where they match

New Member

Hello guys,

So I have struggled writing search pipeline for this senario:

I have comparing unique id(numerical value) in 3 different fields (id1,id2,id3). The data looks something like:
1 | id2 | id3
1 3 4
2 4 5
3 5 6
4 6 5
4 5 3

I want to find out where all three columns have a matching value.
For example, here 4 would be a unique value that appears in all three fields.

I have run different seaches:
...|table id1.id2,id3|where id1==id2==id3
...|eval matchname=id2|where id1==matchname <-tried with 2 fields first, no result
...|table id1, id2|eval matchname=if(id1==id2,"y","n")
...|stats values(id1) by id2,id_3

I am new to Splunk so please excuse my lack of knowledge on the different commands. But i feel like I might be missed a big concept in Splunk Search Language.

Advance thanks for any help on this.

-New Splunk Enthusiast

0 Karma


This should do, starting from your initial table:

... | table id_1 id_2 id_3 | eval foo = 42 | untable foo name value | stats dc(name) as dc by value | where dc=3

That will distinct-count the field names per value, and only keep those values that occur in all three field names.

0 Karma