topic Re: Display only values found in two searches in Splunk Search

Display only values found in two searches

atl215 — Fri, 03 May 2019 21:58:27 GMT

Re: Display only values found in two searches

atl215 — Fri, 03 May 2019 21:59:31 GMT

I would like to list the values that match

Re: Display only values found in two searches

adonio — Sat, 04 May 2019 00:30:57 GMT

try this:

(index=rap sourcetype="joyner lucas" albums=*) OR (index=country sourcetype="lil Nas" songs=*)
| eval check_match = coalesce(albums,songs)
| stats count by check_match 
| where count > 1

here is an example to try anywhere:

| makeresults count=1
| eval data = "x,y,z,123;;;x,y,z,124;;;x,y,z,125;;;x,y,z,126;;;a,b,c,123;;;a,b,c,134;;;a,b,c,125;;;a,b,c,136"
| makemv delim=";;;" data 
| mvexpand data
| rex field=data "(?<idx>[^\,]+)\,(?<st>[^\,]+)\,(?<letter>[^\,]+)\,(?<number>.+)"
| eval album = if(idx=="x",number,null())
| eval song = if(idx="a",number,null())
| table idx st album song
| rename COMMENT as "the above generates data below is the solution" 
| search (idx=x st=y album=*) OR (idx=a st=b song=*)
| eval check_match = coalesce(album,song)
| stats count by check_match
| where count > 1

hope it helps

Re: Display only values found in two searches

atl215 — Mon, 06 May 2019 14:00:42 GMT

From this answer, how would I chart the matches of this search?

 (index=rap sourcetype="joyner lucas" albums=*) OR (index=country sourcetype="lil Nas" songs=*)
 | eval check_match = coalesce(albums,songs)
 | stats count by check_match 
 | where count > 1