Hi,
Currently, my Splunk search is:
sourcetype="Blacklist" OR sourcetype="log" | eval blacklisted=if(sourcetype=="Blacklist",_raw,null()) | fields - _raw | fields blacklisted,SRC
I am able to see two fields, blacklisted and SRC.
May i ask if it is possible to do the following:
Thanks a lot!
If by "matches between the 2 fields" you mean if they equal each other, you can do this:
sourcetype="Blacklist" OR sourcetype="log" | eval blacklisted=if(sourcetype=="Blacklist",_raw,null()) | fields - _raw | fields blacklisted,SRC | eval matches = if(blacklisted==SRC, "match", "no match")
If you're thinking of something else then please elaborate.
I think you should look at this:
http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/CommonEvalFunctions
Thanks a lot!
If by "matches between the 2 fields" you mean if they equal each other, you can do this:
sourcetype="Blacklist" OR sourcetype="log" | eval blacklisted=if(sourcetype=="Blacklist",_raw,null()) | fields - _raw | fields blacklisted,SRC | eval matches = if(blacklisted==SRC, "match", "no match")
If you're thinking of something else then please elaborate.
Yes, this is what i'm thinking of. Thanks a lot!