Splunk Search

How to compare field3 with common and unique values from field1 and field2?

raju4244
Explorer

Dear All,

I have one question. I have the data like below:

field1:

itema
itemb
itemb
itemc
itemd
iteme
iteme

field2:

itemc
itemd
itemd
iteme

mainfield

itemf
itemc
itemz

I used the search below to get common items and unique items on each fields (field1 and field2).

index=foo source=* |  eval commonfield=coalesce(field1,field2) | stats values(source) as source by commonfield | table commonfield

Now I want to compare the common values from field1 and field2 with mainfield. I want to know what are the common items and unique items on commonfield and main field

All the data is in same index and sourcetype.

Thanks.
Raj

Tags (2)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Does the main field appears in the same events as field1 and field2?

0 Karma

raju4244
Explorer

no, thats in diiferent source

0 Karma

woodcock
Esteemed Legend

Like this:

index=foo source=* | eval commonfield=coalesce(field1,field2) | stats values(*) as * by commonfield | where commonfield=mainfield

And

index=foo source=* | eval commonfield=coalesce(field1,field2) | stats values(*) as * by commonfield | where commonfield!=mainfield
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...