topic Re: What is this query executing? in Splunk Search

What is this query executing?

abhi04 — Mon, 04 Jun 2018 09:49:23 GMT

Please explain the below query and why the source i.e. source="dfw1lvpap415" is mentioned in the join ?

index="auto_preprod_sa3_host"  ":" AND ("architecture" OR  "cpu*" OR "CPU(s)" OR "model*" OR "Model*") | rex field=_raw "(?.*)\:\s(?.*\d+|\w+|[a-z0-9#.)-])"   
| rex field=source "/output/(?.*\w\d)\_" | join Parameter [search index="auto_preprod_sa3_host"  ":" AND ("architecture" OR  "cpu*" OR "CPU(s)" OR "model*" OR "Model*") source="*dfw1lvpap415*" 
|rex field=_raw "(?.*)\:\s(?.*\d+|\w+|[a-z0-9#.)])"]     | table  Parameter, abc,def,Server_Name    | eval  Message=if(match(abc,def), "Same","Not Same")      
| search Parameter=*  AND  NOT (Parameter="Model name" OR Parameter="model name " OR Parameter="model       "  OR  Parameter="cpu MHz       ")  | stats  values(abc) AS Realtime_Configurations values(def) AS Reference_Configurations values(Server_Name) AS Server by Parameter Message    
| where  Message="Not Same"

Re: What is this query executing?

abhi04 — Mon, 04 Jun 2018 09:54:48 GMT

The above query is for CPU configuration comparison.

Re: What is this query executing?

diogofgm — Mon, 04 Jun 2018 11:14:00 GMT

its easier to tell what are you looking to accomplish.

Re: What is this query executing?

skoelpin — Mon, 04 Jun 2018 13:58:10 GMT

This is searching an index and doing 2 extractions, the first one is on raw data and the second one is extracting from source. These have no field names

It's then joining on another search with the common field Parameter and doing another extraction. Its than creating a table with the Parameter field and I'm assuming the fields that were extracted out. It's then creating a new field called message with conditional logic. If it matches then it will give message a value of "same" else it gives it a value of "Not Same". It's then searching for all fields with a Parameter field but excluding the values "Model Name", "model name", "model", and "cpu MHz". Lastly, its listing all its values in a table form and only searching where Message="not same"

No idea for source="dfw1lvpap415". You should do a quick tstats to see if that lives in your data