Splunk Search

Porting ArcSight content to Splunk - compare between two fields of the same event

dragoslungu
Explorer

Hi,

I need to port ArcSight content to Splunk and I'm afraid I stumbled upon a fundamental difference on how to implement filters in ArcSight vs. saved searches in Splunk.

How to filter out events by comparing two event fields against each other ?

For instance, this is a simple search on Windows events and I want to list all the events where the "host" field is different from "dest" field

by searching for host!=dest, I get all events, even those where host=dest.

If I'm comparing each of the fields to constants or strings, it works; the problem is how to compare between two event fields.

I hope I made sense and I'd appreciate any hint.

Thank you.

0 Karma

dragoslungu
Explorer

SOLVED

you need to use "where" operator:

index=* | where host!=dest

Thanks !

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...