topic Re: Receive Delta from two different sources in Splunk Enterprise

How to receive delta from two different sources?

hillsmtb7 — Tue, 24 May 2022 17:42:15 GMT

We are trying to output computers that appear in index A but not appear in Index B. We want to ensure computers are being deployed with the correct software on them.

Index A
----------------------------------------------------
| name | objectclass | field 1 | field 2 | field 3 |
----------------------------------------------------
| PC 1 | computer | x | x | x |
| PC 2 | computer | x | x | x |
| PC 3 | computer | x | x | x |
| PC 4 | computer | x | x | x |
| PC 5 | computer | x | x | x |
| PC 6 | computer | x | x | x |

Index B
----------------------------------------------------
| cname | objectclass | field 1 | field 2 | field 3 |
----------------------------------------------------
| PC 1 | computer | x | x | x |
| PC 2 | computer | x | x | x |
| PC 5 | computer | x | x | x |
| PC 6 | computer | x | x | x |

I need the output to only show PC 3 and 4 so this can be supplied to the proper team to install the application. I have tried join with type left and outer. Also I have attempted stats. However, I believe my logic is wrong.

Your help is greatly appreciated.

Re: Receive Delta from two different sources

ITWhisperer — Tue, 24 May 2022 14:26:56 GMT

Try something along these lines

(index="A" OR index="B") | stats value(*) as * values(index) as index by name | where mvcount(index)=1 AND index="A"

Re: Receive Delta from two different sources

hillsmtb7 — Tue, 24 May 2022 14:54:15 GMT

That did not work. It returns 0 results and when we run the indexes independently index A shows PC3 and index B does not contain PC3. Could it be an issue with the filed names being different for the computer names?

Re: Receive Delta from two different sources

ITWhisperer — Tue, 24 May 2022 15:15:51 GMT

Yes. Just rename one of the fields to the same name or use coalese() to eval the fields together i.e. when name is null, set it to cname.

Re: Receive Delta from two different sources

hillsmtb7 — Tue, 24 May 2022 15:30:19 GMT

Negative GhostRider...did not work.

Re: Receive Delta from two different sources

ITWhisperer — Tue, 24 May 2022 15:46:05 GMT

What have you tried?

Re: Receive Delta from two different sources

hillsmtb7 — Tue, 24 May 2022 16:11:06 GMT

I have tried the first suggestion you provided. Then on the rename of the filed I tried the following:

(index="A" ) OR (index="B" sourcetype="B.1")

| rename cname as name

| stats value(*) as * values(index) as index by name

| where mvcount(index)=1 AND index="A"

Just for clarity, I have ran the index independently and receive the following for PC3:

index="A" name=PC3 (Results: PC3 appears in the list for the past 30 days)

index="B" sourcetype="B.1" cname=PC3 (Results: PC3 does not appear for the past 30 days.)

Need only the machines that show up in index A and not in index B to display.

Re: Receive Delta from two different sources

ITWhisperer — Tue, 24 May 2022 16:34:09 GMT

What do you get for this?

(index="A" ) OR (index="B" sourcetype="B.1") | rename cname as name | stats value(*) as * values(index) as index by name | where name="PC3"

Re: Receive Delta from two different sources

hillsmtb7 — Tue, 24 May 2022 17:25:48 GMT

This is what I get.

Re: Receive Delta from two different sources

ITWhisperer — Tue, 24 May 2022 17:53:57 GMT

That would seem to suggest that PC3 doesn't exist in either index as that name - have the names been shortened or extended in either index or been modified e.g. uppercase, etc. - the names will have to match precisely (unless we do something different)?

Re: Receive Delta from two different sources

hillsmtb7 — Tue, 24 May 2022 18:57:41 GMT

Well that's exactly not true as PC3 does exist on the first index just not in the second one when searched individually.

Index A

Index B

Re: Receive Delta from two different sources

ITWhisperer — Tue, 24 May 2022 19:03:34 GMT

The initial search is case insensitive. What do you find when you try it like this?

index="A" | where name="PC3"

index="B" | where name="PC3"

Re: Receive Delta from two different sources

hillsmtb7 — Tue, 24 May 2022 19:11:57 GMT

I wont try index B cause there is no data there for that PC, but in index A I attempted the following:

index=A

| where name="PC3" (Results: Computer appears)

But when I search as follows:

index=A

| where name="pc3" (Results: Computer does not appear)

It is case sensitive at the where. I thought it was case insensitive throughout. Where do I change the case?

Re: Receive Delta from two different sources

ITWhisperer — Tue, 24 May 2022 19:46:35 GMT

Try this

(index="A" OR index="B") | eval name=upper(coalesce(name,cname)) | stats value(*) as * values(index) as index by name | where mvcount(index)=1 AND index="A"

Re: Receive Delta from two different sources

hillsmtb7 — Tue, 24 May 2022 21:12:15 GMT

We might be getting closer. Why are we placing the following:

values(*) as *

Re: Receive Delta from two different sources

ITWhisperer — Wed, 25 May 2022 05:06:30 GMT

This is gathering the values from the two events into one event

index	name	field1	...
A	PC2	xyz	...
B	PC2	xyz	...

become

index	name	field1	...
A, B (multi-value)	PC2	xyz	...

index has a mvcount = 1 when it appears in only one index - which is what you are after, and you check that that index is "A" to find the ones that are in "A" and not "B"