Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

I need to compare two results based on one part of a field ( and not the entire field ). To give more details ,

$
0
0
I have search A which gives out results like field A, field B , field C where field C is a combination of two halves like part 1.part2. Now I want to compare/combine the results of this search with another search that gives out columns like field D , field E, field C ( here field C contains only part 2 and does not have part 1 ). My question is : 1. How do I compare/combine results of search 1 with results of search 2 to see events that have part 2 of field C matching/same.

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>