Value of Field A = Value of Field B

[usernamen6213]

Hi Everyone, 

First time using Splunk Community. I have been working with Splunk for about a year and I've been doing okay but I'm trying to use Active Directory logs to identify when accounts are created. I was looking for ways to do this. I tried using userAccountControl or pwdLastSet=0 but what I thought was a sure thing was to use uSNCreated=uSNChanged. But when I add that to the search, I get no result even though I can see that the original creation record has the same value for both. 

Any suggestions are greatly appreciated. Thank you!

[PickleRick · Accepted solution]

I suppose you're trying to add simple fielda=fieldb condition to your search. It won't work. Search conditions match against a pre-defined values or sets of values. To match complicated conditions (including dynamic ones, like comparing different fields) you need a "where" command. Like:

index=a source=b field="whatever" ...
| where fielda=fieldb

[usernamen6213]

Thank you @PickleRick 

[ITWhisperer]

Have these fields already been extracted for each event? Are they present in all events? How did you add uSNCreated=uSNChanged to the search  - can you share your search?