Splunk Search

How to Compare two fields and exclude if the values are same?

Woodpecker
Path Finder

Hi,

I have two fields: field 1 and field 2

field1        field 2

ABC           AA\ABC

DEF           DD\DEF

GHI            GG\JKL

Now I need to compare both these fields and exlcude if there is a match

So in the above case it should return only
field1         field 2
GHI             GG\JKL

Could someone help me on this, please?

Tags (1)
0 Karma
1 Solution

Woodpecker
Path Finder

This solved the issue 

| where '%field2'!='field1'

 

View solution in original post

0 Karma

Woodpecker
Path Finder

This solved the issue 

| where '%field2'!='field1'

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| where NOT match(field2,field1)
0 Karma

Woodpecker
Path Finder

@ITWhisperer ,
Sorry, but this not working in my case

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Probably because your example does not adequately reflect your actual data e.g. do you have special characters which would disrupt a regex match?

0 Karma

Woodpecker
Path Finder

@ITWhisperer yes..

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...