Matching / Compaire 2 Fields

[mklhs]

Hello,

i would like to find out if both systems deliver the same output.
The output of both systems is written to the same index and differ by the component contained in the event.

e.g:
user=x component=old target=foobar
user=x component=new target=foobar

I now want to find out with a query whether my old and my new system worked the same way and entered the same destination for the event. My question is now how do I write a query that tells me if the output of the old and new system is not the same

Thanks for your Help and your Time

[renjith_nair · Accepted solution]

@mklhs ,

Try something similar to

|stats latest(eval(if(component="old",target,null()))) as old,latest(eval(if(component="new",target,null()))) as new
|eval status=if(old==new,"Same","Different")