Graylog comparison of two fields

Graylog Central (peer support)
1

I am trying to do something like this

Where I am trying to compare two fields a tmestamp and last changed which are both unix timestamps. If they are both the same show me those results type of thing
Following the example in that post I did this
c_event_last_state_change IS c_event_timestamp
However this doesn’t seem to work at all, or doesn’t give me the outcome I am expecting. Is this even possible or is there another way to possibly accomplish this?

2

I actually ended up resolving this using a pipeline

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.