Splunk Search

How to compare two fields with every value?

username13
Explorer

Hi guys. I'm completly new to Splunk. Sorry if my question seems kinda stupid 🙂

I have some log-data including a GUID. Those are separated in two kinds: "error" and "times". Sometimes, an error-log has the same GUID as a times-log. I need to count those double GUIDs, for that reason I have to extract the GUIDs from their original field und compare them with each other.

I managed to extract them with Regex into two new fields. But now I'm searching for an opportunity to compare every error-GUID with every times-GUID.

Thanks for your help! 🙂

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Are the two GUIDs in the same event or different events?  If so, a simple where command should find the duplicates.

... | where errorGUID = timesGUID

If they're in different events, then we'll need to create a common field so the stats command can group events.  Then keep only the results where two events have the same GUID.

... | eval GUID=coalesce(errorGUID, timesGUID)
| stats count, values(*) as * by GUID
| where count=2

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Are the two GUIDs in the same event or different events?  If so, a simple where command should find the duplicates.

... | where errorGUID = timesGUID

If they're in different events, then we'll need to create a common field so the stats command can group events.  Then keep only the results where two events have the same GUID.

... | eval GUID=coalesce(errorGUID, timesGUID)
| stats count, values(*) as * by GUID
| where count=2

 

---
If this reply helps you, Karma would be appreciated.

username13
Explorer

It worked. Thank you so much!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...