Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Diff dashboard
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
My search query is like this : index=main source=file1.txt | stats values(wrk) as "Work Name", values(name) as "Name", values(folder) as "Folder Name", values(version) as "Version"|transpose |rename column as Properties, "row 1" as "File 1"|appendcols[ search index=main source=file1.txt | stats values(wrk) as "Work Name", values(name) as "Name", values(folder) as "Folder Name", values(version) as "Version" |transpose|rename "row 1" as "File 2", column as Properties]
the output table obtained is like
Properties File 1 File 2
Work Name wrk1 wrk2
Name name1 name1
Folder Name folder1 folder1
Version version1 version2
here i dont want the rows with same values to be displayed,(like Name and Folder Name in the example) how to hide them ? which command should i use?
please help
Thank you
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Just add the where command to compare the fields.
... | where File1 != File2
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Just add the where command to compare the fields.
... | where File1 != File2
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Close. The double quote is used for comparing values. To compare fields with spaces in their names, surround them in single quotes.
...|where 'File 1' != 'File 2.txt'
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ahhh 😞 !! thanks BobM but
here where clause is not working..
cant we use "" inside where clause as my source file names have space between them like
|where "File 1" != "File 2.txt"
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Meet the .conf26 AI Agent Buildathon Winners
Trusted Autonomy in the SOC: A Maturity Journey
Supercharging Windows Security Detection Performance: Introducing Hybrid Field ...
