Splunk Search

Search comparison not working

randy_moore
Path Finder

Hi - 
I have some data that looks like this, which ingests into splunk with no issues at all

 

 

 

11/24/2021 08:47:21.321,"category":"transaction","tc"="93","amount_approved":"9.99","amount_requested":"493.95" etc etc etc
11/24/2021 08:45:14.121,"category":"transaction","tc"="93","amount_approved":"5.99","amount_requested":"5.99" etc etc etc
11/24/2021 08:45:14.121,"category":"transaction","tc"="01","amount_approved":"6.99","amount_requested":"6.99" etc etc etc

 

 

 

I want to do a a search to filter out the transactions to only see where the amounts differ

 

 

 

index=ABC sourcetype=XZX category=transaction tc=93 amount_approved!=amount_requested

 

 

 

 That simple search doesn't work.     splunk is not filtering on the amount_approved!=amount_requested comparison.     In the example above I would get both "tc=93" transactions from the sample data , instead of just getting the first one.

If I remove the amount_approved!=amount_requested  from the search and add it to a where clause like this

 

 

index=ABC sourcetype=XZX category=transaction tc=93
|where amount_approved!=amount_requested

 

 

it works fine as I only get 1 event back.
What is wrong with my initial search line?

I would like to not read in all of the transactions before I filter, hence the need to put the comparison on the search line. 

Labels (1)
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The first query fails because the search command cannot handle a field name on both sides of an expression.  The where command, however, does handle such an expression.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The first query fails because the search command cannot handle a field name on both sides of an expression.  The where command, however, does handle such an expression.

---
If this reply helps you, Karma would be appreciated.

randy_moore
Path Finder

Thanks @richgalloway    I knew it was something simple that I had forgotten about.   Says exactly that in the search reference guide, here: Search Ref Guide 

Comparing two fields

To compare two fields, do not specify index=myindex fieldA=fieldB or index=myindex fieldA!=fieldB with the search command. When specifying a comparison_expression, the search command expects a <field> compared with a <value>. The search command interprets fieldB as the value, and not as the name of a field.

Use thewherecommand to compare two fields.

Thanks again!

Sum_Var
Engager

Appreciate the details. Very Helpful!

 

0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...