Splunk Search

Diff dashboard

smolcj
Builder

Hi,
My search query is like this : index=main source=file1.txt | stats values(wrk) as "Work Name", values(name) as "Name", values(folder) as "Folder Name", values(version) as "Version"|transpose |rename column as Properties, "row 1" as "File 1"|appendcols[ search index=main source=file1.txt | stats values(wrk) as "Work Name", values(name) as "Name", values(folder) as "Folder Name", values(version) as "Version" |transpose|rename "row 1" as "File 2", column as Properties]
the output table obtained is like
Properties File 1 File 2
Work Name wrk1 wrk2
Name name1 name1
Folder Name folder1 folder1

Version version1 version2

here i dont want the rows with same values to be displayed,(like Name and Folder Name in the example) how to hide them ? which command should i use?
please help
Thank you

Tags (1)
0 Karma
1 Solution

BobM
Builder

Just add the where command to compare the fields.

... | where File1 != File2

View solution in original post

BobM
Builder

Just add the where command to compare the fields.

... | where File1 != File2

BobM
Builder

Close. The double quote is used for comparing values. To compare fields with spaces in their names, surround them in single quotes.

...|where 'File 1' != 'File 2.txt'

smolcj
Builder

Ahhh 😞 !! thanks BobM but
here where clause is not working..
cant we use "" inside where clause as my source file names have space between them like
|where "File 1" != "File 2.txt"

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...