Splunk Search

How to check whether or not two different fields match?

doesntmatter
Observer

I'm trying something like this:

 

my base search | where data.value1 == data.value2 

my base search | where data.value1 != data.value2

I've tried variations of match = case as well.

 

A single event has the two fields I want to compare. 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @doesntmatter,

let me understand: data.value1 and data.value2 are two different fields of the same event?

if yes, you could run something like this:

my_base_search 
| rename data.value1 AS value1 data.value2 AS value2
| eval condition=if(value1=value2,"Equal","Different") 
| ...

the first rename is useful because, sometimes the dot in the fieldname gives problems.

In few words, in this way you create a condition (the eval command) to define if the values are equal or different.

If instead the two values aren't in the same event but arrive from a grouping command (e.g. stats), you could use the same approach after the grouping command.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...