Splunk Search

How to only find matches where two tables have the same value?

Hergel
New Member

I have one table called CurrentValue and another called NextValue, I want to be able to only find results where CurrentValue and NextValue have the exact same value. How can I accomplish this?

Tags (2)
0 Karma
1 Solution

Suda
Communicator

Hello,

Could you try to use "where" command to compare 2 fields' value?

(your search) | where CurrentValue=NextValue 
  OR
(your search) | where 'CurrentValue'='NextValue' 

I hope it helps you.

Thank you.

View solution in original post

0 Karma

Hergel
New Member

Thanks, that worked 🙂

0 Karma

Suda
Communicator

Hello,

Could you try to use "where" command to compare 2 fields' value?

(your search) | where CurrentValue=NextValue 
  OR
(your search) | where 'CurrentValue'='NextValue' 

I hope it helps you.

Thank you.

0 Karma

Hergel
New Member

Thanks, that worked 🙂

0 Karma

strive
Influencer

CurrentValue and NextValue are tables right? the value should be same in any one column or multiple columns. Need more details to answer your question.

0 Karma
Get Updates on the Splunk Community!

Simplifying the Analyst Experience with Finding-based Detections

    Splunk invites you to an engaging Tech Talk focused on streamlining security operations with ...

[Puzzles] Solve, Learn, Repeat: Word Search

This challenge was first posted on Slack #puzzles channelThis puzzle is based on a letter grid containing ...

[Puzzles] Solve, Learn, Repeat: Advent of Code - Day 4

Advent of CodeIn order to participate in these challenges, you will need to register with the Advent of Code ...