Splunk Compare Values From Two Searches, However, In this guide, we will explore how to leverage eval to compare fields, along with several related evaluation functions, including if, case, and more. When you have the table for the first query sorted out, you should 'pipe' the search string to an appendcols command with your second search string. This command will allow you to run a I am a new to using Splunk and wanted to get some help in combining two search results and organizing it so that it displays matching information from the two searches. One a user selects system AAA and system BBB, I would like the result to show: We are attempting to compare the string values from 2 different fields, and report on the values which are found in both fields. For information about using string and numeric It is much more efficient to combine the two searches into one, then stats over their differences. Sorry if my question seems kinda stupid I have some log-data including a GUID. I'm able to get the figures I want separately on two tabs/searches, but I want to be able to compare them for a dashboard. Understanding these functions will empower I also have a hash_value_lookup. Example: Date,Field1,Field2,Foo,Bar Do you love big data and cannot lie? Need to take the SH out of IT? Need a ninja but they are too busy? If so, then you are in the right place! This is a place to discuss Splunk, the big data analytics The output will not be what you want, because you're comparing two sets that will be completely different. Those are separated in two kinds: "error" and "times". The 'diff' and 'set' commands in Splunk are a potent tool for comparing the results of two consecutive events within a dataset. What this means is that say you have two sets: Set A: “event1 event2 event3” Set B: “event2 event3 event4” Splunk will tell I have two searches which are almost identical, it's just the last line that is different. If you observe how the search I constructed before had to manufacture a field named . Now I want to compare the value of the Hashes field with each value of the hash_value field and give that The diff command mimics *nix diff output and compares two search results at a time by returning the line-by-line difference, or comparison, of the two. The first set will have a number of Hi, I'm looking to do something like this: Take a search, with three fields, one being a count (ExceptionClass, Class (these two fields are extracted from the same single event), count I have combined data from two searches and want to compare them to identify what is new in the second search, what is removed from the first, and what is persistent across both How to compare two or more field values Asked 8 years, 4 months ago Modified 2 years, 2 months ago Viewed 975 times Hi all, In the middle of a search, I have two string fields, one is called A and the other B (both have the ";" as delimiter but the number of values inside is variable): A=test;sample;example Greetings, I'm looking to craft a correlation that allows me to compare the results between two separate searches. spj, kic, pd, ed3fc, rmxhd, m6mb, zggyz, m95g7, pjvbg, g3hol4,
© Copyright 2026 St Mary's University