Splunk Search

Display fields with different values only between 2 row

yuming1127
Path Finder

Hi,

I cannot found any similar thread on this issue, my aim is to display fields with different values between 2 row, so my problem will be...

my search...

statistics view from my search

productcolorproduct_iddescription1description2description3description4
phonebluetag_1passpass fail 
phonebluetag_2failpasspassfail

 

Desired_outcome

1)

productcolorproduct_iddescription1description3
phonebluetag_1pass 
phonebluetag_2failpass

 

or

2)  if option 1 not achievable,  maybe this work as well.

product_iddescription1description3
tag_1pass 
tag_2failPass

 

Appreciate your help.

Labels (5)
Tags (3)
0 Karma
1 Solution

ITWhisperer
Legend
| makeresults 
| eval _raw="product	color	product_id	description1	description2	description3	description4
phone	blue	tag_1	pass	pass	 	fail 
phone	blue	tag_2	fail	pass	pass	fail"
| multikv forceheader=1
| fields - _* linecount
| transpose 0
| eval same=if('row 1'=='row 2',"same","different")
| where same="different"
| fields - same
| transpose 0 header_field=column
| fields - column

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @yuming1127,

one little question: the pair product/color is unique in your results or not?

if yes, you can use stats to have your need.

your_search
| stats dc(product_id) AS dc_product_id values(product_id) AS product_id dc(description1) AS dc_description1 values(description1) AS description1	dc(description3) AS dc_description3 values(description3) AS description3 BY product color
| where dc_product_id>1 OR dc_description1>1 OR dc_description1>3
| table product color description1 description3

Ciao.

Giuseppe

0 Karma

yuming1127
Path Finder

great effort but I don't get desired outcome,
description1-description4 is just example, which the values are randomize, my real data have like 70 + description.
btw thanks for the reply

0 Karma

ITWhisperer
Legend

Sorry @gcusello, but this doesn't quite work if some of the values are null as they don't get included in the dc count. However, you could use fullnull to get around this. (Also, there is a typo in the where clause, it should be dc_description3>1.

0 Karma

ITWhisperer
Legend
| makeresults 
| eval _raw="product	color	product_id	description1	description2	description3	description4
phone	blue	tag_1	pass	pass	 	fail 
phone	blue	tag_2	fail	pass	pass	fail"
| multikv forceheader=1
| fields - _* linecount
| transpose 0
| eval same=if('row 1'=='row 2',"same","different")
| where same="different"
| fields - same
| transpose 0 header_field=column
| fields - column

View solution in original post

yuming1127
Path Finder

Great one,
any idea to exclude product and color from the matching? or re-append product and color after the matching.

0 Karma

yuming1127
Path Finder

@ITWhisperer 

It's ok, i'm okay to edit the query
| eval same=if('row 1'=='row 2' AND 'row 1' != "phone" AND 'row 1' != "blue","same","different")

able to get expected outcome (1),

Thanks alot

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.