I have the below output after my xyseries
comp, Field1,Field2,Field3 A,a1,a1,a1 B,b1,b2,b3 C,c1,c2,c2
I want to add a last column which compares 2nd to 4th column values and give compare results.
comp, Field1,Field2,Field3,Match A,a1,a1,a1,Yes B,b1,b2,b3,No C,c1,c2,c2,No
Note: the no of fields are dynamic there can be n fields Field1...Fieldn
Any help in this regard will be much appreciated.
I'm assuming a simple comparison with the field names won't be possible for you?
eval comparison=if(Field1=Field3, "Yes","No")
@Tiago - Thanks for the quick response. This works if the fields are known. Looking for a way to achieve this when the no of fields and field names are dynamic.
Try this, here I had considered Field*(Field1,Field2,....)
source="values.csv" host="dpds" sourcetype="csv" | eval match="" | foreach Field* [ eval match = match.",".<<FIELD>>] | makemv match delim="," | mvexpand match | eventstats dc(match) as temp by comp | eval match = if(temp==1,"Yes","No") | mvcombine match | eval match = mvdedup(match) | table comp,Field*,match
@vnravikumar - That worked like a charm. Thank you. Just needed one adjustment - replace <> with '<>' when field names contain special characters like Field1_name or Field2-job etc...