Splunk Search

Return results when value of one field is not equal to value of another field

jumper4000
Explorer

Hi, I'm trying to create a search where the value of one field is not equal to value of another field. For example I have these events -

EventCode=5555
UsernameA=Jack
UsernameB=Bob

EventCode=555
UserNameA=Steve
UserNameB=Steve

My goal is to only show the result when UsernameA and UsernameB are different. Does anyone how to do this?

Thanks

Tags (1)

gkanapathy
Splunk Employee
Splunk Employee

There is no efficient way to do this in Splunk, but pretty much you need:

EventCode=whatever sourcetype=mysourcetype UserNameA=* UserNameB=* | where UserNameA!=UserNameB

this will work, but won't run terribly quickly.

Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...