Splunk Conditional Statement

[sagartiwari]

I am using below query where my A (0012ABC) Component is an alphanumeric and B is a string (ab) but its considering A as numeric only

base query |eval details = if(A>1 AND B >1,A,"Alone")|dedup details| table details

want the results as if in my result set there is a duplicate value occurrence with respect to the combination of A and B then show me that value for A(duplicate values only.

E.g.
ColumnA Coulmn B
0001AB ab
0002AB pq
0001AB ab

expected result set
details
0001AB

[jkat54]

To convert the integer to a string, use eval

| eval a=tostring(a)

https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/Eval

[richgalloway]

It doesn't make sense to compare strings to integers.

To show ColumnA where there are duplicate combinations of ColumnA and ColumnB, use stats.

base query
| stats count by ColumnA ColumnB
| where count > 1
| table ColumnA