Splunk Search
Highlighted

How can I compare two fields that I get from my search result?

Explorer

I want to compare the two columns that I get dynamically from my search result. I want to compare both fields.

Sourcetype             result
xxxx                   normal
xxxx                   elevated
xxxx                   critical.

I want to compare both values, whether any sourcetype is critical or the final result is critical, or else any sourcetype is elevated result is elevated. if everything is normal result is "normal".
can we compare like this.
Thanks.

0 Karma
Highlighted

Re: How can I compare two fields that I get from my search result?

Motivator

try this

.. | eval result=case(sourcetype=="critical" AND result=="critical","critical",sourcetype=="elevated" AND result=="elevated","elevated",sourcetype=="normal" AND result=="normal","normal")

0 Karma
Highlighted

Re: How can I compare two fields that I get from my search result?

SplunkTrust
SplunkTrust

Errrm, I might be missing something, but based on what you are saying, that is, if my sourcetype is critical result should be critical and so on, why don't you simply do the following:

| eval result = sourcetype

Or even better, use the value of sourcetype directly instead of defining a new field.

If on the other hand, you just want to compare against certain values of the sourcetype field before you assign the value of result, then you can use the following syntax:

| eval result = case(
    match(sourcetype, "keyword_for_critical_sourcetypes") , "critical",
    match(sourcetype, "keyword_for_elevated_sourcetypes"), "elevated",
    match(sourcetype, "keyword_for_normal_sourcetypes"), "normal",
    1==1, "everything else"
)

Note you can use an exact matching ( == ) instead of match if you know exactly what you are comparing against.

Hope that helps,
J

0 Karma
Highlighted

Re: How can I compare two fields that I get from my search result?

Esteemed Legend

Just add this:

| eval MyAnswer=1 
| chart count useother=f limit=0 over MyAnswer BY sourcetype 
| foreach * [eval <<FIELD>>="<<FIELD>>"]
| eval MyAnswer=coalesce(critical. elaveated, normal, "ERROR!")

View solution in original post

0 Karma
Highlighted

Re: How can I compare two fields that I get from my search result?

Splunk Employee
Splunk Employee

Hey @prashanthberam, did any of these Answers work for you? If so, please accept one.

0 Karma
Highlighted

Re: How can I compare two fields that I get from my search result?

SplunkTrust
SplunkTrust

@prashanthberam please do not forget to accept an answer if you are happy with it

0 Karma