How do you compare a field value with another field in the following event?

[ben_leung]

Example data:

From:                  To:
1. www.google.com      www.google.com/123
2. www.yahoo.com        www.yahoo.com/567
3. www.yahoo.com/567    www.google.com
4. www.splunk.com       www.splunk.com/login

How would you compare the "From:" field second event" with the "To:" field value in the third event?

I want to just display the events that have values that are the same in the preceding event. That can be done probably with and eval, but I would first have to be able to compare values from different events and different fields.

My final results would be like the example but only display events two and three.

[somesoni2 · Accepted solution]

Try this

Your base search giving above two fields From and To | streamstats current=f window=1 last(From) as prevFrom 

This should give you From value from 2nd row in the 3rd with name prevFrom, which can be used to filter.