Answer by warren for How to check if two field match in SPLUNK

Try using where with match:

<spl>
| where !match(field1,field2)
| stats count by field1 field 2

from User warren – Stack Overflow https://stackoverflow.com/questions/73722651/how-to-check-if-two-field-match-in-splunk/73722923#73722923
via IFTTT