Splunk Search

How to create an eval column in a table that says "match" or "no match" if the value of all columns is the same/or not for each row?

samiksha86
New Member
test    host1   host2   host3   temp
test1   x1  x1  x1  Match
test2   y1  y2  y1  No match
test3   z1  z1  z3  No match
Tags (3)
0 Karma

niketn
Legend

@samiksha86, based on the sample data provided try the following run anywhere search. Command from makeresults till | table test host1 host2 host3 generates the sample data as per the question.

|  makeresults
|  eval data="test1 x1 x1 x1;test2 y1 y2 y1;test3 z1 z2 z3"
|  makemv data delim=";"
|  mvexpand data
|  makemv data delim=" "
|  eval test=mvindex(data,0),host1=mvindex(data,1),host2=mvindex(data,2),host3=mvindex(data,3)
|  table test host1 host2 host3
|  eval temp=host1.",".host2.",".host3
|  makemv temp delim=","
|  eval temp=mvdedup(temp), matchCount=mvcount(temp), temp=if(matchCount=1,"Matched","Not Matched")
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

abhi04
Communicator

@niketnilay, what if the the values i.e. x1,x2y1,z1,etc are subject to changes and we have to compare then.
How to compare in that scenario?

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...