Return results when value of one field is not equal to value of another field

[jumper4000]

Hi, I'm trying to create a search where the value of one field is not equal to value of another field. For example I have these events -

EventCode=5555
UsernameA=Jack
UsernameB=Bob

EventCode=555
UserNameA=Steve
UserNameB=Steve

My goal is to only show the result when UsernameA and UsernameB are different. Does anyone how to do this?

Thanks

[gkanapathy]

There is no efficient way to do this in Splunk, but pretty much you need:

EventCode=whatever sourcetype=mysourcetype UserNameA=* UserNameB=* | where UserNameA!=UserNameB

this will work, but won't run terribly quickly.