Splunk Search

Return results when value of one field is not equal to value of another field

jumper4000
Explorer

Hi, I'm trying to create a search where the value of one field is not equal to value of another field. For example I have these events -

EventCode=5555
UsernameA=Jack
UsernameB=Bob

EventCode=555
UserNameA=Steve
UserNameB=Steve

My goal is to only show the result when UsernameA and UsernameB are different. Does anyone how to do this?

Thanks

Tags (1)

gkanapathy
Splunk Employee
Splunk Employee

There is no efficient way to do this in Splunk, but pretty much you need:

EventCode=whatever sourcetype=mysourcetype UserNameA=* UserNameB=* | where UserNameA!=UserNameB

this will work, but won't run terribly quickly.

Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...