Splunk Search

How to compare two fields in a event and list out the field when one of the fields does not exist?

Path Finder

I have a multiple events in a log file which contains field A and field B but not in all the events, I need to compare the field B with field A, If field B does not exist in any of the events then I need to list out the field B values.

Tags (3)
0 Karma

Esteemed Legend

That last sentence does not seem to make sense. Maybe the last B should be A? Sample events and output mockup for both scenarios will help us help you.


Can you give sample logs? Or explain with sample values?

Get Updates on the Splunk Community!

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...