topic Is it possible to do a Splunk query that can give me difference in values? in Getting Data In

Is it possible to do a Splunk query that can give me difference in values?

AruBhende — Mon, 23 Jan 2023 16:00:57 GMT

We have ingested into Splunk logs from our application - these logs include two keys - stageType and correlation id, along with other keys. I have to find a list of correlation ids that are returned for one stageType and not for other stageType. I realise Splunk queries cannot be written similar to SQL I am not very conversant with Splunk - I just normally get by - using simpler queries.

Hence hoping, someone can help me with a query that gives me the list - so I can do further analysis to find out the reason for differences, which should not normally exist.

Is it possible to do it in Splunk? Can someone help me with the query?

index=grp-applications sourcetype="kafka:status" stageType IN ("STAGEA", "STAGEB" ) env=qa | dedup env, correlationId, stageType | stats count by env, correlationId, stageType

Thank you

Re: Is it possible to do a Splunk query that can give me difference in values

scelikok — Sat, 21 Jan 2023 02:08:02 GMT

Hi @AruBhende,

Please try below;

index=grp-applications sourcetype="kafka:status" stageType IN ("STAGEA", "STAGEB" ) env=qa | stats values(stageType) as stageType by env correlationId | where mvcount(stageType) = 1

Re: Is it possible to do a Splunk query that can give me difference in values

AruBhende — Sat, 21 Jan 2023 02:21:51 GMT

Hi,

I tried it but it is not giving the difference, it is giving all the correlation ids. For STAGEA, there are about 55000 events returned and for STAGEB, about 50000. The above query is returning 105,000 events, whereas I want to get only the 5000 - which is the difference. Is it possible ?

Thanks

Re: Is it possible to do a Splunk query that can give me difference in values

scelikok — Sat, 21 Jan 2023 02:36:08 GMT

Hi @AruBhende,

If you see all correlation ids, they should be different between stages. Can you paste a sample log containing both stages?

Re: Is it possible to do a Splunk query that can give me difference in values

AruBhende — Sat, 21 Jan 2023 03:05:19 GMT

Sorry, it was a mistake on my part. It should have been sourceCorrelationId instead of correlationId. Both are valid keys in the log. When I used sourceCorrs a am accepting that elationId in the example you provided, it worked.

I am accepting that as solution.

Thanks for your help.