Splunk Search

compare two fields with against other field not in order

kirrusk
Communicator

Hi 

 

I'm trying to compare two fields against one field, can anyone please suggest how can I achieve this.

Cluster           pronames1   pronames2    pronames3
CLUSTER1       PRO2                PRO1                 PRO1
CLUSTER1       PRO2                PRO2                 PRO2
CLUSTER1       PRO3                PRO4                 PRO4
CLUSTER1       PRO3                PRO4                 PRO3
CLUSTER1       PRO1                PRO5                 PRO5
CLUSTER1       PRO8                PRO2                 PRO8

here my intention is to compare   (pronames1 == pronames2) and (pronames1== pronames3)
but all three fields are not in order.

The expected result should be, display pronames2 and pronames3 not in pronames1

like below

Cluster                      pronames2    pronames3
CLUSTER1                     PRO4                PRO4
CLUSTER1                     PRO5                PRO5
CLUSTER1                      n/a                    PRO8

 

@gcusello 

Labels (4)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

To drop a field simply

| fields - pronames1

It is not clear how you are comparing the fields so that you get the expected results. Can you explain what you are trying to do in more detail?

0 Karma

kirrusk
Communicator

@ITWhisperer  I'm trying to compare pronames2 fields values against pronames1 & pronames3 against pronames1

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval result=if(pronames1==pronames2,if(pronames1=pronames3,"match","no match"),"no match")
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...