want to compare two fields and add new column for result

[Snehraj]

I have gone through so many posts but have not found what I am looking for.

here is what I am looking for.

I am trying to compare multiple columns and get result (same or Not same) in new columns.

Example I have below data

Parameter Server A Server B Server C
Port1 100 101 100
Port2 200 200 200

Expected data

parameter result Server A Server B Server C
Port1 Not Same 100 101 100
Port2 Same 200 200 200

index="A" source="A" | rex field=_raw ()|join parameter [search index="A" source"B" | rex field=_raw() ]

[niketn · Accepted solution]

@Snehraj, try the following run anywhere example. Commands from | makeresults till | fields - data _* generate dummy data as per the question. You can fill in your existing search which returns table 1 instead.

| makeresults 
| fields - _time 
| eval data="Port1 100 101 100;Port2 200 200 200" 
| makemv data delim=";" 
| mvexpand data 
| makemv data delim=" " 
| eval Parameter=mvindex(data,0),ServerA=mvindex(data,1),ServerB=mvindex(data,2),ServerC=mvindex(data,3) 
| fields - data _*
| foreach Server* [| eval serverValues=mvappend(serverValues,<<FIELD>>)]
| eval uniqueServerCount=mvcount(mvdedup(serverValues))
| eval result=if(uniqueServerCount=1,"same","not same")
| fields - serverValues uniqueServerCount

PS: rename field names might be required to make sure only Servers are picked up for foreach command template and not Parameter field. Please let me know if you are unable to figure that out for your scenario.