Eval If Multiple Date Values Match or Do Not Match

[Razziq]

Hello,

I have a script gathering the last updated timestamp of three different files and I'm ingesting that data into Splunk to help identify when one of the three files fails to update.  What I am trying to do is build a dashboard table view of all of the dates and eval any that do match the others as "Not_Matching".

In the below screenshot i'd like to identify Servername2.file as "Not_Matching" (since it has a Timestamp of 2022-01-21 12:XX, instead of 2022-01-21 15:XX like the other two files) using an eval statement if possible. Note that all three files live within the same Index/Source/Sourcetype.

Thanks for any help!

[yuanliu]

The question needs more clarification.  If every search returns exact three (3) results with a Timestamp field that can be precisely compared (i.e., no rounding into minutes or such), you can simply mark any "oddball" as not  matching.

| stats values("HostFile") as Files by Timestamp
| eval Match = if(mvcount(Files) > 1, "Matching", "Not matching")

Even in this simplistic scenario, you need to decide how to handle cases when all three files carry different Timestamp.  The above method says "Not matching" when this happens.