Splunk Search

How to create an eval column in a table that says "match" or "no match" if the value of all columns is the same/or not for each row?

samiksha86
New Member
test    host1   host2   host3   temp
test1   x1  x1  x1  Match
test2   y1  y2  y1  No match
test3   z1  z1  z3  No match
Tags (3)
0 Karma

niketn
Legend

@samiksha86, based on the sample data provided try the following run anywhere search. Command from makeresults till | table test host1 host2 host3 generates the sample data as per the question.

|  makeresults
|  eval data="test1 x1 x1 x1;test2 y1 y2 y1;test3 z1 z2 z3"
|  makemv data delim=";"
|  mvexpand data
|  makemv data delim=" "
|  eval test=mvindex(data,0),host1=mvindex(data,1),host2=mvindex(data,2),host3=mvindex(data,3)
|  table test host1 host2 host3
|  eval temp=host1.",".host2.",".host3
|  makemv temp delim=","
|  eval temp=mvdedup(temp), matchCount=mvcount(temp), temp=if(matchCount=1,"Matched","Not Matched")
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

abhi04
Communicator

@niketnilay, what if the the values i.e. x1,x2y1,z1,etc are subject to changes and we have to compare then.
How to compare in that scenario?

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...