Splunk Search

Diff dashboard

Builder

Hi,
My search query is like this : index=main source=file1.txt | stats values(wrk) as "Work Name", values(name) as "Name", values(folder) as "Folder Name", values(version) as "Version"|transpose |rename column as Properties, "row 1" as "File 1"|appendcols[ search index=main source=file1.txt | stats values(wrk) as "Work Name", values(name) as "Name", values(folder) as "Folder Name", values(version) as "Version" |transpose|rename "row 1" as "File 2", column as Properties]
the output table obtained is like
Properties File 1 File 2
Work Name wrk1 wrk2
Name name1 name1
Folder Name folder1 folder1

Version version1 version2

here i dont want the rows with same values to be displayed,(like Name and Folder Name in the example) how to hide them ? which command should i use?
please help
Thank you

Tags (1)
0 Karma
1 Solution

Builder

Just add the where command to compare the fields.

... | where File1 != File2

View solution in original post

Builder

Just add the where command to compare the fields.

... | where File1 != File2

View solution in original post

Builder

Close. The double quote is used for comparing values. To compare fields with spaces in their names, surround them in single quotes.

...|where 'File 1' != 'File 2.txt'

Builder

Ahhh 😞 !! thanks BobM but
here where clause is not working..
cant we use "" inside where clause as my source file names have space between them like
|where "File 1" != "File 2.txt"

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!