Make search string with comparison of fields values (field1=field2)

Graylog Central (peer support)
1

Hi!!! I have a question about basic search.
Is it possible to compare fields in graylog? Something like: “HEY, GRAYLOG! PLEASE FIND ME ALL EVENTS WHERE field1=field2”

My aim is to find all events which has TargetUserName not equal to SubjectUserName

For examle:
(EventID:4723 OR EventID:4724) AND (TargetUserName:<>SubjectUserName:) - it’s not works

Thanks

2

Here is the queries explanation : http://docs.graylog.org/en/2.2/pages/queries.html

You can do searches like " field_name IS NOT ‘value’ ", so you could try applying it to comparing fields instead.

Like, " field_one IS NOT field_two"

If I’m wrong, I’m counting on a more knowledgeable person to prove me wrong.

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.