Splunk Search

Matching / Compaire 2 Fields

mklhs
Path Finder

Hello,

i would like to find out if both systems deliver the same output.
The output of both systems is written to the same index and differ by the component contained in the event.

e.g:
user=x component=old target=foobar
user=x component=new target=foobar

I now want to find out with a query whether my old and my new system worked the same way and entered the same destination for the event. My question is now how do I write a query that tells me if the output of the old and new system is not the same

Thanks for your Help and your Time

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@mklhs ,

Try something similar to

|stats latest(eval(if(component="old",target,null()))) as old,latest(eval(if(component="new",target,null()))) as new
|eval status=if(old==new,"Same","Different")

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@mklhs ,

Try something similar to

|stats latest(eval(if(component="old",target,null()))) as old,latest(eval(if(component="new",target,null()))) as new
|eval status=if(old==new,"Same","Different")

View solution in original post

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!