Splunk Search

Search to compare fields where field1 has both entries in field2?

karthik4455
Explorer

I wish to run a query where I need to see if field1 has both entries in field2. Ex: I need to query the results like A & E which has both Escalated and Closed status.

Field status
A Escalated
A Closed
B Closed
C Escalated
D Escalated
E Escalated
E Closed

Tags (2)
1 Solution

somesoni2
Revered Legend

Try this

your base search giving fields 'Field' and 'status' | eventstats  count(status) as statusCount by Field | where statusCount > 1

Update

Give this a try

 your base search giving fields 'Field' and 'status' | stats values(status) as status by Field delim=" & " | where mvcount(status) > 1 | nomv status

View solution in original post

somesoni2
Revered Legend

Try this

your base search giving fields 'Field' and 'status' | eventstats  count(status) as statusCount by Field | where statusCount > 1

Update

Give this a try

 your base search giving fields 'Field' and 'status' | stats values(status) as status by Field delim=" & " | where mvcount(status) > 1 | nomv status

karthik4455
Explorer

Thanks a lot. It worked.

0 Karma

somesoni2
Revered Legend

Try the updated answer.

0 Karma

karthik4455
Explorer

Can you tell me how I can filter the output as follows:
You could notice the output doesn't have B,C & D because they should be dropped.

A Escalated & Closed
E Escalated & Closed

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...