Splunk Search

Matching / Compaire 2 Fields

mklhs
Path Finder

Hello,

i would like to find out if both systems deliver the same output.
The output of both systems is written to the same index and differ by the component contained in the event.

e.g:
user=x component=old target=foobar
user=x component=new target=foobar

I now want to find out with a query whether my old and my new system worked the same way and entered the same destination for the event. My question is now how do I write a query that tells me if the output of the old and new system is not the same

Thanks for your Help and your Time

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@mklhs ,

Try something similar to

|stats latest(eval(if(component="old",target,null()))) as old,latest(eval(if(component="new",target,null()))) as new
|eval status=if(old==new,"Same","Different")

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@mklhs ,

Try something similar to

|stats latest(eval(if(component="old",target,null()))) as old,latest(eval(if(component="new",target,null()))) as new
|eval status=if(old==new,"Same","Different")

View solution in original post

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!