Splunk Search

How to Compare two fields and exclude if the values are same?

Woodpecker
Path Finder

Hi,

I have two fields: field 1 and field 2

field1        field 2

ABC           AA\ABC

DEF           DD\DEF

GHI            GG\JKL

Now I need to compare both these fields and exlcude if there is a match

So in the above case it should return only
field1         field 2
GHI             GG\JKL

Could someone help me on this, please?

Tags (1)
0 Karma
1 Solution

Woodpecker
Path Finder

This solved the issue 

| where '%field2'!='field1'

 

View solution in original post

0 Karma

Woodpecker
Path Finder

This solved the issue 

| where '%field2'!='field1'

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| where NOT match(field2,field1)
0 Karma

Woodpecker
Path Finder

@ITWhisperer ,
Sorry, but this not working in my case

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Probably because your example does not adequately reflect your actual data e.g. do you have special characters which would disrupt a regex match?

0 Karma

Woodpecker
Path Finder

@ITWhisperer yes..

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...