Below is my search output for the SPL i am running.
How do i exclude the field records which are identical between 2 fields like in this case -- (n88888 & n7777)
I tried using there where clause /Search , but without any success ..
SPL used to display fields records which are not identical ---
|splunk command | where db_1 != server_2 ( Not wokring )
|splunk Command | fields db_1,server_2 | search db_1 !=server_2 ( Not working )
Any clue/help will be appreciated ?
ok , I was able to resolve using a single quote around the field name along with a where clause.
|splunk command | where 'db_1'!='server_2'
Found the below input in the splunk documentation which helped ..
where 'host-name'="buttercup" If the expression references a field name that contains characters other than a-z, A-Z, 0-9, or the underscore ( _ ) character, the field name must be surrounded by single quotation marks.