How to show result of if a field not contains another field?

[hoseineagle]

Hi all,

I have two fields. I want a splunk query that not a field contains another field.

For example field1 is ::ffff:127.0.0.1 and the field2 is 127.0.0.1 , so I dont want to see the queries that field1 contains field2.

Thank you

[somesoni2]

Try something like this (replace line one with your search)

| makeresults | eval field1="::ffff:127.0.0.1", field2="127.0.0.1" 
| where like(field1,"%".field2)

[yuanliu]

It looks like the OP wants the opposite.  So

| where NOT like(field1,"%".field2)

Anyway, what you are asking seems quite domain-specific.  So, this may not be the generalization your application calls for.

[PickleRick]

If you want a simple comparison between two fields in the same event you just need to do a where command. Like

<your_base_search> 
| where fielda!=fieldb

Be warned however that it works much slower than if you were looking for some specific field values since Splunk has to retrieve all results from your base search and then - event by event - parse out your fields and verify whether they fit your criteria or not. So you should be as specific as you can in your base search anyway to limit data Splunk needs to fetch from indexes.

EDIT: I see you don't want a simple equality comparison but a more complicated one. That's ok, you can use the "where" command with any expression that yields boolean results so you can use - for example - like() function.

[gcusello]

Hi @hoseineagle,

could you share some sample of your logs?

Ciao.

Giuseppe