Splunk Search

is there a way to compare two list columns transfer values to another column?

leirga11
New Member

i have events that has columns like this:

date1 date2
01/01/2018 01/01/2018
01/02/2018 01/26/2018
01/03/2018 03/12/2018
01/04/2018 04/1/2018
01/05/2018
01/06/2018

I want to compare them and extract same values to another column. is it possible? thanks in advance.

Tags (1)
0 Karma

493669
Super Champion

try this:

...|table date1 date2 | eval common = if(date1=date2,date1,null())

use if condition to check if it matches and if not matched then its value will be null

0 Karma

leirga11
New Member

I used this command but nothing happened.

0 Karma

493669
Super Champion

try the updated query

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...