Splunk Search

How to Compare two fields and exclude if the values are same?

Woodpecker
Path Finder

Hi,

I have two fields: field 1 and field 2

field1        field 2

ABC           AA\ABC

DEF           DD\DEF

GHI            GG\JKL

Now I need to compare both these fields and exlcude if there is a match

So in the above case it should return only
field1         field 2
GHI             GG\JKL

Could someone help me on this, please?

Labels (1)
Tags (1)
0 Karma
1 Solution

Woodpecker
Path Finder

This solved the issue 

| where '%field2'!='field1'

 

View solution in original post

0 Karma

Woodpecker
Path Finder

This solved the issue 

| where '%field2'!='field1'

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| where NOT match(field2,field1)
0 Karma

Woodpecker
Path Finder

@ITWhisperer ,
Sorry, but this not working in my case

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Probably because your example does not adequately reflect your actual data e.g. do you have special characters which would disrupt a regex match?

0 Karma

Woodpecker
Path Finder

@ITWhisperer yes..

0 Karma
Get Updates on the Splunk Community!

Monitoring Postgres with OpenTelemetry

Behind every business-critical application, you’ll find databases. These behind-the-scenes stores power ...

Mastering Synthetic Browser Testing: Pro Tips to Keep Your Web App Running Smoothly

To start, if you're new to synthetic monitoring, I recommend exploring this synthetic monitoring overview. In ...

Splunk Edge Processor | Popular Use Cases to Get Started with Edge Processor

Splunk Edge Processor offers more efficient, flexible data transformation – helping you reduce noise, control ...