Hi,
I need to port ArcSight content to Splunk and I'm afraid I stumbled upon a fundamental difference on how to implement filters in ArcSight vs. saved searches in Splunk.
How to filter out events by comparing two event fields against each other ?
For instance, this is a simple search on Windows events and I want to list all the events where the "host" field is different from "dest" field
by searching for host!=dest, I get all events, even those where host=dest.
If I'm comparing each of the fields to constants or strings, it works; the problem is how to compare between two event fields.
I hope I made sense and I'd appreciate any hint.
Thank you.
