I am trying to compare two multivalue fields using the below search:
index="weblogic" "Dynamic Server List" | rex field=_raw "Host: (?.*).*.Secure.*.Status" max_match=10 | rex field=_raw "Host: (?.*).*.Secure.*.\d{4}\n" max_match=10 | eval DynamicCount=mvcount(DynamicHost) | replace "*'*'* Port: *" with ***:* in DynamicHost,StaticHost|eval StaticCount=mvcount(StaticHost) |streamstats count as id
|stats values(DynamicHost) as DynamicValues values(StaticHost) as StaticValues values(url) as URL by id| eval Status = if(DynamicValues != StaticValues, "NOT OK", "OK")|table URL,DynamicValues,StaticValues,Status|dedup URL,DynamicValues,StaticValues
However, there are instances where the Status is "OK" and it is obvious that the fields do not match. Since I am not allowed to use image tags yet, an example can be found here: http://www.freeimagehosting.net/uploads/d2360a43f1.png
Is there another way to compare the values of these fields that will return a Status of "NOT OK"?
... View more