Hi,
I would like to build a query to compare the var1 and var2 and then determinecount.
Example lets say var1 = "abc" var1 = "cbd" var1 = "dfg"
var2 = "abc" var2 = "cbd" var2 = "z_dfg"
Output should be count matches, mismatches and count of var1 over a period of time.
we need to determine the count of all the matches and mismatches
Abdul Ahad
I would probably put this into a dashboard so you could run the following search:
YourSearch | eval Match=if(var1=var2,"Match","No Match")
And then do post processing for the number of matches and mismatches:
| timechart count by Match
and for the variations of Var1:
| timechart distinct_count(var1)
I was trying to find a way to put it all into one search, but couldn't see an easy way to allow it to chart over time. For a one time result, you could use the following:
YourSearch | eval Match=if(var1=var2,"Match","No Match")
| eventstats distinct_count(var1) as Var1Count
| stats count, first(Var1Count) by Match
It's a bit hokey, though. Perhaps someone will take it the rest of the way.