Splunk Search

Porting ArcSight content to Splunk - compare between two fields of the same event

dragoslungu
Explorer

Hi,

I need to port ArcSight content to Splunk and I'm afraid I stumbled upon a fundamental difference on how to implement filters in ArcSight vs. saved searches in Splunk.

How to filter out events by comparing two event fields against each other ?

For instance, this is a simple search on Windows events and I want to list all the events where the "host" field is different from "dest" field

by searching for host!=dest, I get all events, even those where host=dest.

If I'm comparing each of the fields to constants or strings, it works; the problem is how to compare between two event fields.

I hope I made sense and I'd appreciate any hint.

Thank you.

0 Karma

dragoslungu
Explorer

SOLVED

you need to use "where" operator:

index=* | where host!=dest

Thanks !

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...