Splunk Search

How to compare two fields in two different sourcetypes ?

chimbudp
Contributor

How to compare two fields in two different sourcetypes ?

eg:

Events from sourcetype 1 : int

Tier OS      version
SIT  MAC        v8 
SIT  Windows  v7    
SIT  CentOS     v2  

sourcetype 2 : uat

Tier OS      version   
UAT   MAC        v8 
UAT   Windows  v6    
UAT   CentOS     v2    

I used the query :

index=* sourcetype =int|table OS,INTversion|join[search index=* sourcetype=uat|table UATversion]

Output:

Tier | INTversion |UATversion
MAC | v8 | v8
Windows |v7 | v6 
CentOS | v2 |v2

I need a additional column here like Difference between INT & UAT -

Expected Output:

Tier | INTversion |UATversion | Difference
MAC | v8 | v8 | No
Windows |v7 | v6 |Yes
CentOS | v2 |v2 | No

I tried with some diff , match , eval commands - doesn't helped. Please help in this

Tags (4)
0 Karma

Ayn
Legend

What did you try that didn't work? I expect something like this should do it:

index=* sourcetype =int|table OS,INTversion|join[search index=* sourcetype=uat|table UATversion] | eval Difference=if(INTversion==UATversion,"No","Yes")
Get Updates on the Splunk Community!

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...