[Help] Creating a new Field for matching Value

[Zyon]

Hi,

Currently, my Splunk search is:

sourcetype="Blacklist" OR sourcetype="log" | eval blacklisted=if(sourcetype=="Blacklist",_raw,null()) | fields - _raw | fields blacklisted,SRC 

I am able to see two fields, blacklisted and SRC.

May i ask if it is possible to do the following:

• Create a new field to store values that matches between the 2 fields.

Thanks a lot!

[gkanapathy]

I think you should look at this:

http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/CommonEvalFunctions

[Zyon]

Thanks a lot!

[martin_mueller · Accepted solution]

If by "matches between the 2 fields" you mean if they equal each other, you can do this:

sourcetype="Blacklist" OR sourcetype="log" | eval blacklisted=if(sourcetype=="Blacklist",_raw,null()) | fields - _raw | fields blacklisted,SRC | eval matches = if(blacklisted==SRC, "match", "no match")

If you're thinking of something else then please elaborate.

[Zyon]

Yes, this is what i'm thinking of. Thanks a lot!