Splunk Search

How can I filter my results to compare values in two fields?

cbr654
Path Finder

I have 2 fields called sc_bytes & cs_bytes in my results. How can I then filter my results to give me events when the value for cs_bytes is greater than the value for sc_bytes? Much thanks.

somesoni2
Revered Legend

How about this

your base search cs_bytes>sc_bytes

e.g. index=foo sourcetype=bar cs_bytes>sc_bytes

0 Karma

sideview
SplunkTrust
SplunkTrust

You need the where command. This is one of the big differences between using search vswhere` for subsequently filtering results.

Just add this to your search:

| where cs_bytes > sc_bytes

In search the right hand side of any operator (ie =, >, <) is always assumed to be a literal value (whether or not it's in quotes) but in where unquoted strings on the right hand side are interpreted as the values of that named field.

The other huge difference of course, is that in where you can use any eval functions (ie any of the long list of functions you would more typically see in the eval command.)

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

So to take a simple example, you could filter to only the rows where cs_bytes is greater than BOTH sc_bytes and some_other_bytes

| where cs_bytes > max(sc_bytes,some_other_bytes)
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...