topic Re: Compare Fields in Data Model vs all other Available fields in Knowledge Management

Compare Fields in Data Model vs all other Available fields

admins123 — Tue, 29 Sep 2020 20:19:54 GMT

Hello I'm new to Splunk and I've encountered an issue trying to figure out how to create a search query that will allow me to compare all the fields in a datamodel vs all other fields. Example :I have a datamodel named MyDataModel. This datamodel includes the fields _value, time, _key, location. I would like to create a search that allows me to see all the fields in that particular data model (fields, _value, _key, location) vs all the fields in a specific data set (index=logix_logs) to see if there are any matches. The goal is to see if there are any fields in the datamodel that do not exist in the index=logix_logs data set so that they can be created if need be. Hope that helps. but I'm unsure how to complete the query to give me the information I need. Any help will be greatly appreciated!

Search that brings out all fields in a datamodel:
|datamodel
|spath output=modelName path=modelName
|spath output=foo path=objects{}
|mvexpand foo
|spath input=foo output=objectName path=objectName
|spath input=foo output=foo path=fields{}
|mvexpand foo
|spath input=foo output=fieldName path=fieldName
|spath input=foo output=type path=type
|table modelName,objectName,fieldName,type |search objectName="My DataModel"

Re: Compare Fields in Data Model vs all other Available fields

manish_singh_77 — Thu, 05 Jul 2018 05:51:38 GMT

Which fields are you trying to compare? Could you please elaborate?

Re: Compare Fields in Data Model vs all other Available fields

admins123 — Tue, 29 Sep 2020 20:17:14 GMT

I'm sorry if my question is not very descriptive. Let me attempt to elaborate. I have a datamodel named MyDataModel. This datamodel includes the fields _value, time, _key, location. I would like to create a search that allows me to see all the fields in that particular data model (fields, _value, _key, location) vs all the fields in a specific data set (index=logix_logs) to see if there are any matches. The goal is to see if there are any fields in the datamodel that do not exist in the index=log_logs data set so that they can be created if need be. Hope that helps.