Splunk Search

compare two field values for equality

EricPartington
Communicator

I have the output of a firewall config, i want to make sure that our naming standard is consistent with the actual function of the network object.

I have a table of the name of the object and the subnet and mask. I want to compare the name and name-combo fields to see if they are the same, and show only those that are not the same.

example row
cluster name name-combo subnet bits match
1 FW1-2 NET69.90.64.0-20 NET69.90.64.0-20 69.90.64.0 20 No Match
2 FW1-2 NET69.90.63.0-8 NET69.90.63.0-20 69.90.64.0 20 No Match

here is my search

`abc_firewall_rules` eventtype=subnet [search index="abc_rules" eventtype=subnet | dedup cluster | fields + source] 
| dedup name,cluster | eval name-combo="NET".subnet."-".bits 
| eval match=if(name-combo=name,"Match","No Match")
|  table cluster,name,name-combo,subnet,bits,match

row 1 should show match and row 2 should show no match..

have tried using | where NOT name=name-combo
have tried using | where name!=name-combo

all show ro results found but in my sample data there are rows that do not match and should show up..

any ideas ?

Tags (4)
0 Karma
1 Solution

lguinn2
Legend

I think I have it figured out - it's a weird one! Field names are supposed to contain letters, numerals or the underscore, and must start with a letter. name-combo violates this rule, but Splunk doesn't complain! The reason why it doesn't work is that in the if statement, Splunk interprets your test as `name - combo = name" - this will never match...

So change name-combo to name_combo and it should work.

View solution in original post

brettcave
Builder

i have a similar problem. I apply a filter after stats:

stats dc(field1) as someCount dc(someThing) as otherCount by group | search NOT someCount=otherCount

The above search returns all values, regardless of whether they match or not, so assuming its checking where someCount matches a literal of "otherCount". This works:

... | eval countDiff=someCount-otherCount | search NOT countDiff=0

HTH

0 Karma

lguinn2
Legend

Actually Brett, your problem is different.

| search NOT someCount=otherCount

is interpreted as

| search NOT someCount="otherCount"

search always searches for name=value, whether you use the quotes around the value or not. You could make the first search work by using where instead:

... | stats dc(field1) as someCount dc(someThing) as otherCount by group
| where NOT someCount=otherCount

payal4296
Explorer

what if 1 field  with string "A" is the substring  of flied "B"?
|where B=*A* , 
how can we find out that?


0 Karma

scelikok
Champion

Hi @payal4296,

Please try below; checking if field A is a substring of field B...

| eval A="%".A."%"
| where B like A

 

If this reply helps you an upvote is appreciated.
0 Karma

lguinn2
Legend

I think I have it figured out - it's a weird one! Field names are supposed to contain letters, numerals or the underscore, and must start with a letter. name-combo violates this rule, but Splunk doesn't complain! The reason why it doesn't work is that in the if statement, Splunk interprets your test as `name - combo = name" - this will never match...

So change name-combo to name_combo and it should work.

View solution in original post

EricPartington
Communicator

well getting somewhere now..

appears that my field name-combo is not a string (thanks for your test command).

so i tried to convert the field to string with
eval name-combo=tostring(name-combo)
however not able to get a "string" output from that

0 Karma

lguinn2
Legend

If your search is working properly, you should have output, regardless of whether things match or not. Does this search return any results? What does the search job inspector say?

`abc_firewall_rules` eventtype=subnet [search index="abc_rules" eventtype=subnet | dedup cluster | fields + source] 

I am guessing that this is a problem with your search, not your logic.

0 Karma

EricPartington
Communicator

the search is fine, i get results from that search, the problem appears to be the concat string isnt coming out as a string to compare with

0 Karma

sdaniels
Splunk Employee
Splunk Employee

I usually do some checks on my fields when this happens using eval to makes sure that i'm comparing what I expect. This should be comparing string to string but make the types are ok "eval test = if( isstr(name)", "String", "Not String" } table test)". Everything looks good as far as i can tell.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!