Hello all, brand new to Splunk so please bare with me.
I have two csv files as two different sources with the same type of data in each. It looks like the following:
Source1column1
2000
1000
4000
9000
...
Source2column1
1400
1300
3000
8000
...
I want to be able to compare the first value in Source1column1 "2000" and return how many instances "2000" is greater than all of the numbers in Source2column1. In this case it should return the value of 2. The end result should be a table showing Source1 data and a count of the instances. Then I'm assuming I can perform eval statements on the results from there..
Data Instances
2000 2
1000 0
4000 3
9000 4
Anyhow, in excel I can do this in 5 seconds using if statements and array formulas but I would like to implement the same functionality in Splunk and am just having a hard time getting started with the syntax of comparing two sources and their fields.. Any help is appreciated!
I wouldn't mind using a subsearch to start.. but i could use a good example to help get things going, anyone?
I think this might require subsearching, but I would be intrigued to see if someone can come up with a more elegant solution than subsearching.