I have the below output after my xyseries
comp, Field1,Field2,Field3
A,a1,a1,a1
B,b1,b2,b3
C,c1,c2,c2
I want to add a last column which compares 2nd to 4th column values and give compare results.
Expected Result
comp, Field1,Field2,Field3,Match
A,a1,a1,a1,Yes
B,b1,b2,b3,No
C,c1,c2,c2,No
Note: the no of fields are dynamic there can be n fields Field1...Fieldn
Any help in this regard will be much appreciated.
Hi @bapunpatel
Try this, here I had considered Field*(Field1,Field2,....)
source="values.csv" host="dpds" sourcetype="csv"
| eval match=""
| foreach Field*
[ eval match = match.",".<<FIELD>>]
| makemv match delim=","
| mvexpand match
| eventstats dc(match) as temp by comp
| eval match = if(temp==1,"Yes","No")
| mvcombine match
| eval match = mvdedup(match)
| table comp,Field*,match
Hi @bapunpatel
Try this, here I had considered Field*(Field1,Field2,....)
source="values.csv" host="dpds" sourcetype="csv"
| eval match=""
| foreach Field*
[ eval match = match.",".<<FIELD>>]
| makemv match delim=","
| mvexpand match
| eventstats dc(match) as temp by comp
| eval match = if(temp==1,"Yes","No")
| mvcombine match
| eval match = mvdedup(match)
| table comp,Field*,match
@vnravikumar - That worked like a charm. Thank you. Just needed one adjustment - replace <> with '<>' when field names contain special characters like Field1_name or Field2-job etc...
I'm assuming a simple comparison with the field names won't be possible for you? eval comparison=if(Field1=Field3, "Yes","No")
@Tiago - Thanks for the quick response. This works if the fields are known. Looking for a way to achieve this when the no of fields and field names are dynamic.