Splunk Search

Search comparison not working

randy_moore
Path Finder

Hi - 
I have some data that looks like this, which ingests into splunk with no issues at all

 

 

 

11/24/2021 08:47:21.321,"category":"transaction","tc"="93","amount_approved":"9.99","amount_requested":"493.95" etc etc etc
11/24/2021 08:45:14.121,"category":"transaction","tc"="93","amount_approved":"5.99","amount_requested":"5.99" etc etc etc
11/24/2021 08:45:14.121,"category":"transaction","tc"="01","amount_approved":"6.99","amount_requested":"6.99" etc etc etc

 

 

 

I want to do a a search to filter out the transactions to only see where the amounts differ

 

 

 

index=ABC sourcetype=XZX category=transaction tc=93 amount_approved!=amount_requested

 

 

 

 That simple search doesn't work.     splunk is not filtering on the amount_approved!=amount_requested comparison.     In the example above I would get both "tc=93" transactions from the sample data , instead of just getting the first one.

If I remove the amount_approved!=amount_requested  from the search and add it to a where clause like this

 

 

index=ABC sourcetype=XZX category=transaction tc=93
|where amount_approved!=amount_requested

 

 

it works fine as I only get 1 event back.
What is wrong with my initial search line?

I would like to not read in all of the transactions before I filter, hence the need to put the comparison on the search line. 

Labels (1)
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The first query fails because the search command cannot handle a field name on both sides of an expression.  The where command, however, does handle such an expression.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The first query fails because the search command cannot handle a field name on both sides of an expression.  The where command, however, does handle such an expression.

---
If this reply helps you, Karma would be appreciated.

randy_moore
Path Finder

Thanks @richgalloway    I knew it was something simple that I had forgotten about.   Says exactly that in the search reference guide, here: Search Ref Guide 

Comparing two fields

To compare two fields, do not specify index=myindex fieldA=fieldB or index=myindex fieldA!=fieldB with the search command. When specifying a comparison_expression, the search command expects a <field> compared with a <value>. The search command interprets fieldB as the value, and not as the name of a field.

Use thewherecommand to compare two fields.

Thanks again!

Sum_Var
Engager

Appreciate the details. Very Helpful!

 

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...