How do you compare dynamic field values created after xyseries?

[bapunpatel]

I have the below output after my xyseries

comp, Field1,Field2,Field3
A,a1,a1,a1
B,b1,b2,b3
C,c1,c2,c2

I want to add a last column which compares 2nd to 4th column values and give compare results.

Expected Result

comp, Field1,Field2,Field3,Match

A,a1,a1,a1,Yes
B,b1,b2,b3,No
C,c1,c2,c2,No

Note: the no of fields are dynamic there can be n fields Field1...Fieldn

Any help in this regard will be much appreciated.

[vnravikumar · Accepted solution]

Hi @bapunpatel

Try this, here I had considered Field*(Field1,Field2,....)

source="values.csv" host="dpds" sourcetype="csv" 
| eval match="" 
| foreach Field* 
    [ eval match = match.",".<<FIELD>>] 
| makemv match delim="," 
| mvexpand match 
| eventstats dc(match) as temp by comp 
| eval match = if(temp==1,"Yes","No") 
| mvcombine match 
| eval match = mvdedup(match) 
| table comp,Field*,match

[bapunpatel]

@vnravikumar - That worked like a charm. Thank you. Just needed one adjustment - replace <> with '<>' when field names contain special characters like Field1_name or Field2-job etc...

[tiagofbmm]

I'm assuming a simple comparison with the field names won't be possible for you? eval comparison=if(Field1=Field3, "Yes","No")

[bapunpatel]

@Tiago - Thanks for the quick response. This works if the fields are known. Looking for a way to achieve this when the no of fields and field names are dynamic.