Splunk Search

Diff dashboard

smolcj
Builder

Hi,
My search query is like this : index=main source=file1.txt | stats values(wrk) as "Work Name", values(name) as "Name", values(folder) as "Folder Name", values(version) as "Version"|transpose |rename column as Properties, "row 1" as "File 1"|appendcols[ search index=main source=file1.txt | stats values(wrk) as "Work Name", values(name) as "Name", values(folder) as "Folder Name", values(version) as "Version" |transpose|rename "row 1" as "File 2", column as Properties]
the output table obtained is like
Properties File 1 File 2
Work Name wrk1 wrk2
Name name1 name1
Folder Name folder1 folder1

Version version1 version2

here i dont want the rows with same values to be displayed,(like Name and Folder Name in the example) how to hide them ? which command should i use?
please help
Thank you

Tags (1)
0 Karma
1 Solution

BobM
Builder

Just add the where command to compare the fields.

... | where File1 != File2

View solution in original post

BobM
Builder

Just add the where command to compare the fields.

... | where File1 != File2

BobM
Builder

Close. The double quote is used for comparing values. To compare fields with spaces in their names, surround them in single quotes.

...|where 'File 1' != 'File 2.txt'

smolcj
Builder

Ahhh 😞 !! thanks BobM but
here where clause is not working..
cant we use "" inside where clause as my source file names have space between them like
|where "File 1" != "File 2.txt"

0 Karma
Get Updates on the Splunk Community!

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...