Splunk Search

How to create an eval column in a table that says "match" or "no match" if the value of all columns is the same/or not for each row?

samiksha86
New Member
test    host1   host2   host3   temp
test1   x1  x1  x1  Match
test2   y1  y2  y1  No match
test3   z1  z1  z3  No match
Tags (3)
0 Karma

niketn
Legend

@samiksha86, based on the sample data provided try the following run anywhere search. Command from makeresults till | table test host1 host2 host3 generates the sample data as per the question.

|  makeresults
|  eval data="test1 x1 x1 x1;test2 y1 y2 y1;test3 z1 z2 z3"
|  makemv data delim=";"
|  mvexpand data
|  makemv data delim=" "
|  eval test=mvindex(data,0),host1=mvindex(data,1),host2=mvindex(data,2),host3=mvindex(data,3)
|  table test host1 host2 host3
|  eval temp=host1.",".host2.",".host3
|  makemv temp delim=","
|  eval temp=mvdedup(temp), matchCount=mvcount(temp), temp=if(matchCount=1,"Matched","Not Matched")
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

abhi04
Communicator

@niketnilay, what if the the values i.e. x1,x2y1,z1,etc are subject to changes and we have to compare then.
How to compare in that scenario?

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...