Splunk Search

How to search by comparing two String attributes that are unequal?

akhil11
Loves-to-Learn

Below is the usual Splunk Search line in addressVal is not equal to outAddressVal.

I tried below Search but it did not help

index= *  addressVal outAddressVal| where (rtrim(ltrim('addressVal ')) != rtrim(ltrim('outAddressVal')))

Content line is like below

addressVal = WV ,outAddressVal= RA

addressVal = CA,outAddressVal= RA

addressVal = WV ,outAddressVal= RA

addressVal = WV ,outAddressVal= RA
Labels (4)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

I think the confusion comes from how field name is constructed during extraction; specifically, the first field name is most likely 'addressVal', not 'addressVal '.  Therefore,

index= *  addressVal outAddressVal| where (rtrim(ltrim('addressVal')) != rtrim(ltrim('outAddressVal')))

should work for your data. 

Meanwhile, Splunk's key-value extraction ignores spaces surrounding equal sign ("="), as well as trailing blanks after the last consecutive non-space character in value.  (Unless you use custom extraction algorithms.)  This means that the values probably do not contain spaces, either.  In other words,

index= *  addressVal outAddressVal
| where 'addressVal' != 'outAddressVal'

may suffice.  But if you feel necessary to both ltrim() and rtrim(), @isoutamo's suggestion of trim() would be a better choice.

0 Karma

akhil11
Loves-to-Learn

Thank you for your response. Yes - both the fields shows in the list of interested fields on left bottom side of splunk search

0 Karma

PickleRick
SplunkTrust
SplunkTrust

And you're sure your field names are properly cased?

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

It those field are from you events and you want to compare content of them (removing spaces and tab) then you can do it like this

| where trim(addressVal) != trim(outAddressVal)

If there are no spaces or tabs inside outer letters like " asdsda ". But if there are those inside string then you need to use your original without those ' over your fieldnames. If you are using it like 'addressVal ' then the fieldname  is 'addressVal ' not 'addressVal'.

r. Ismo

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Are your fields addressVal and outAddressVal getting parsed out from the event? If they aren't your "where" won't work because you don't have anything to compare.

0 Karma
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...