Hi, I'm trying to create a search where the value of one field is not equal to value of another field. For example I have these events -
EventCode=5555
UsernameA=Jack
UsernameB=Bob
EventCode=555
UserNameA=Steve
UserNameB=Steve
My goal is to only show the result when UsernameA and UsernameB are different. Does anyone how to do this?
Thanks
There is no efficient way to do this in Splunk, but pretty much you need:
EventCode=whatever sourcetype=mysourcetype UserNameA=* UserNameB=* | where UserNameA!=UserNameB
this will work, but won't run terribly quickly.