Solved: Unable to compare two numerical fields - Splunk Community

Splunk Search

i have two fields that are numerical fields. when I try a search that says:

index="test" AND field1 > field2

i get no results when I know that shouldn't be the case. Any help would be greatly appreciated.

thanks

-JustAnotherStudent

1 Solution

Solution

index="test" | where field1 > field2

View solution in original post

Thank you for the assistance

Solution

index="test" | where field1 > field2

Get Updates on the Splunk Community!

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

In cybersecurity, defenders respond to threats. Architects design the systems that stop them. As ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...