Splunk Search

How to create an eval column in a table that says "match" or "no match" if the value of all columns is the same/or not for each row?

samiksha86
New Member
test    host1   host2   host3   temp
test1   x1  x1  x1  Match
test2   y1  y2  y1  No match
test3   z1  z1  z3  No match
Tags (3)
0 Karma

niketn
Legend

@samiksha86, based on the sample data provided try the following run anywhere search. Command from makeresults till | table test host1 host2 host3 generates the sample data as per the question.

|  makeresults
|  eval data="test1 x1 x1 x1;test2 y1 y2 y1;test3 z1 z2 z3"
|  makemv data delim=";"
|  mvexpand data
|  makemv data delim=" "
|  eval test=mvindex(data,0),host1=mvindex(data,1),host2=mvindex(data,2),host3=mvindex(data,3)
|  table test host1 host2 host3
|  eval temp=host1.",".host2.",".host3
|  makemv temp delim=","
|  eval temp=mvdedup(temp), matchCount=mvcount(temp), temp=if(matchCount=1,"Matched","Not Matched")
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

abhi04
Communicator

@niketnilay, what if the the values i.e. x1,x2y1,z1,etc are subject to changes and we have to compare then.
How to compare in that scenario?

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...