Hello,
is there an easy possibility to get all events that have non matching field values after an outer join? Here is an example what I tried allready:
sourcetype=typ1 | eval Number = Number1 | join type=outer Number [search sourcetype= type2 | eval Number = Number2]
This gives me all events where field Number1 and field Number2 are equal and not equal.
How can I get just these events now, where they are not equal?
Thanks for help.
C_Sparn
I found a solution now!
It looks like this:
sourcetype=typ1 | eval Number = Number1 | join type=outer Number [search sourcetype= type2 | eval Number = Number2] |search NOT Number2 = *
OR another way is this:
sourcetype=typ1 | eval Number = Number1 | join type=outer Number [search sourcetype= type2 | eval Number = Number2] |search NOT sourcetype = type2
Greetings
C_Sparn
I found a solution now!
It looks like this:
sourcetype=typ1 | eval Number = Number1 | join type=outer Number [search sourcetype= type2 | eval Number = Number2] |search NOT Number2 = *
OR another way is this:
sourcetype=typ1 | eval Number = Number1 | join type=outer Number [search sourcetype= type2 | eval Number = Number2] |search NOT sourcetype = type2
Greetings
C_Sparn
Maybe something like this?
sourcetype=typ1 | eval Number = Number1 | eval NumberA = Number | join type=outer Number [search sourcetype= type2 | eval Number = Number2 | eval NumberB = Number] | where NumberA != NumberB
This gives 0 results back. But thanks for the suggestion.