How to check if two field match in SPLUNK

3.1k Views Asked by At

number1= AnyNumber from 1 to 100 number2= AnyNumber from 1 to 100, This is how my data looks in Splunk

{[-]
   field1: number1,
   fiedl2: number2,
   ...
}

I want to check if these two fields match or doesn't, my Splunk Query

| search filed1 != field2
| stats count by field1,field2
2

There are 2 best solutions below

1
warren On

Try using where with match:

<spl>
| where !match(field1,field2)
| stats count by field1 field 2
1
Milton Palaguachi On

After adding the single quotes around the field2. I was able to get the data for the list of fields that are not matching! | where field1 != 'field2' | stats count by field1, field2