Splunk Search

How to Compare two fields and exclude if the values are same?

Woodpecker
Path Finder

Hi,

I have two fields: field 1 and field 2

field1        field 2

ABC           AA\ABC

DEF           DD\DEF

GHI            GG\JKL

Now I need to compare both these fields and exlcude if there is a match

So in the above case it should return only
field1         field 2
GHI             GG\JKL

Could someone help me on this, please?

Tags (1)
0 Karma
1 Solution

Woodpecker
Path Finder

This solved the issue 

| where '%field2'!='field1'

 

View solution in original post

0 Karma

Woodpecker
Path Finder

This solved the issue 

| where '%field2'!='field1'

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| where NOT match(field2,field1)
0 Karma

Woodpecker
Path Finder

@ITWhisperer ,
Sorry, but this not working in my case

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Probably because your example does not adequately reflect your actual data e.g. do you have special characters which would disrupt a regex match?

0 Karma

Woodpecker
Path Finder

@ITWhisperer yes..

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...