How to Compare Values Based on Multiple Field Matches

[rdhdr]

Hello, I have the following dataset. It consists of configuration parameters from multiple systems. Each system has somewhere in the neighborhood of 3000-5000 parameters, some of which will not exist in all systems. I am trying to come up with a list of unique combinations of parameters with an Matching flag which shows whether the value is identical between both systems. It should indicate a false flag if the parameter exists in either system, but not the other, or if the parameter exists in both systems but with different values.

The parameters are identified by a unique combination of SERVICE_NAME, FILE_NAME, SECTION and KEY (all four are required to be the same). And the system is identified by SID. The data look like this:

SID	SERVICE_NAME	FILE_NAME	SECTION	KEY	VALUE
AAA	index	global.ini	global	timezone_dataset	123
AAA	dpserver	index.ini	password policy	minimal_password_length	16
AAA	index	index.ini	flexible_table	reclaim_interval	3600
AAA	dpserver	global.ini	abstract_sql_plan	max_count	1000000
BBB	dpserver	index.ini	password policy	minimal_password_length	16
BBB	index	index.ini	password policy	minimal_password_length	25
BBB	dpserver	global.ini	abstract_sql_plan	max_count	1000000
BBB	index	index.ini	mergedog	check_interval	60000

The data is in a dashboard, along with drop-downs to select two systems to be compared. One a user selects system AAA and system BBB, I would like the result to show:

SERVICE_NAME	FILE_NAME	SECTION	KEY	Match
index	global.ini	global	timezone_dataset	No
dpserver	index.ini	password policy	minimal_password_length	Yes
index	index.ini	flexible_table	reclaim_interval	No
dpserver	global.ini	abstract_sql_plan	max_count	Yes
index	index.ini	password policy	minimal_password_length	No
index	index.ini	mergedog	check_interval	No

I have tried many different SPL searches, but none have provided the intended result.

I would greatly appreciate any assistance or guidance.

Cheers,

David

[rdhdr]

Wow, that was a lot simpler than the solutions I was trying to get working. Thank you!

[ITWhisperer · Accepted solution]

| stats values(SID) as SID values(VALUE) as VALUE by SERVICE_NAME FILE_NAME SECTION KEY
| eval match=if(mvcount(SID) = 2 AND mvcount(VALUE) = 1,"Yes", "No")