topic Re: How do you find details about results using the set command with a diff argument? in Splunk Search

How do you find details about results using the set command with a diff argument?

aa274t — Mon, 11 Feb 2019 22:11:24 GMT

I am using two searches

Search1 search 2
1 1
2 2
3 3
5 4

Using set diff gives me the result. I don't want to use join.

set diff [search index=ABC sourcetype=PQRS| stats count by x_orderno | fields - count]
[search index=DEF sourcetype=WXYZ| stats count by x_orderno | fields - count]

x_orderno
5
4

I want the result as
x_orderno sourcetype
5 PQRS
4 WXYZ

Kindly suggest.

TIA

Re: How do you find details about results using the set command with a diff argument?

somesoni2 — Tue, 12 Feb 2019 03:03:56 GMT

Try like this

(index=ABC sourcetype=PQRS) OR (index=DEF sourcetype=WXYZ)
| stats values(sourcetype) as sourcetype by x_orderno
| where mvcount(sourcetype)=1

Re: How do you find details about results using the set command with a diff argument?

woodcock — Tue, 12 Feb 2019 08:35:01 GMT

Like this:

| makeresults 
| eval raw="sourcetype=PQRS,x_orderno=1 sourcetype=WXYZ,x_orderno=1 sourcetype=PQRS,x_orderno=2 sourcetype=WXYZ,x_orderno=2 sourcetype=PQRS,x_orderno=3 sourcetype=WXYZ,x_orderno=3 sourcetype=PQRS,x_orderno=5 sourcetype=WXYZ,x_orderno=4" 
| makemv raw 
| mvexpand raw 
| rename raw AS _raw 
| kv

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| stats dc(sourcetype) AS sourcetypeCount values(sourcetype) AS sourcetype BY x_orderno
| where sourcetypeCount==1
| table x_orderno sourcetype

Re: How do you find details about results using the set command with a diff argument?

aa274t — Tue, 12 Feb 2019 16:52:11 GMT

Awesome. Thanks 🙂