Hi
I'm trying to compare two fields against one field, can anyone please suggest how can I achieve this.
Cluster pronames1 pronames2 pronames3
CLUSTER1 PRO2 PRO1 PRO1
CLUSTER1 PRO2 PRO2 PRO2
CLUSTER1 PRO3 PRO4 PRO4
CLUSTER1 PRO3 PRO4 PRO3
CLUSTER1 PRO1 PRO5 PRO5
CLUSTER1 PRO8 PRO2 PRO8
here my intention is to compare (pronames1 == pronames2) and (pronames1== pronames3)
but all three fields are not in order.
The expected result should be, display pronames2 and pronames3 not in pronames1
like below
Cluster pronames2 pronames3
CLUSTER1 PRO4 PRO4
CLUSTER1 PRO5 PRO5
CLUSTER1 n/a PRO8
To drop a field simply
| fields - pronames1
It is not clear how you are comparing the fields so that you get the expected results. Can you explain what you are trying to do in more detail?
@ITWhisperer I'm trying to compare pronames2 fields values against pronames1 & pronames3 against pronames1
| eval result=if(pronames1==pronames2,if(pronames1=pronames3,"match","no match"),"no match")