Compare data between 2 indexes

surekhasplunk — Thu, 23 Jan 2020 14:22:38 GMT

Hi i am using below query to get the results for Ip

index=shinken sourcetype=shinken_alarms Level=HARD Status!=UP Status!=OK Status!=UNKNOWN NOT [|inputlookup Shinken_Flapping_Devices.csv | rename Hostname as Device | fields Device] | lookup   KV_UNICORN.csv  Device output  "Infrastructure Name" Environment Type Ip| fillnull "Infrastructure Name"  | search "Infrastructure Name"!=0 | search Environment="Production"  OR Environment="Production - Backup"  | stats count by Ip

Then i have another query which give me results by IP

index="spectrum"  * | spath "alarm.@id" |spath "alarm.attribute{}.$" | spath "alarm.attribute{}.@id" | search "alarm.attribute{}.$"=psehlx20| eval foo=_cd | rename "alarm.attribute{}.$" as value "alarm.attribute{}.@id" as attr | table _time foo attr value| eval id=_cd | eval value=mvzip(attr,value) | mvexpand value | eval attr=mvindex(split(value,","),0) | eval value=mvindex(split(value,","),1) | lookup attr_alarm_spectrum.csv attr OUTPUT field | table _time,field,value,foo | fillnull field,value,foo  | eval {field}=value | fields - field,value | stats values(*) as * by _time,foo | fields - foo  | eval Severity=if(Severity="3","Critical",if(Severity="2","Major","Minor")) | search Severity=* (Name="***" OR IP="*")  | lookup  State_of_the_Asset_List_on_Unicorn.csv Ip as IP output  "Infrastrucure Name" | lookup spectrum_database_v2.csv Network_Address as IP  output Topology_Model_Name_String
| table _time, Severity,Name,IP,Secure_Domain,Type,Title,Landscape,Acknowledged,Ticket_ID "Topology_Model_Name_String" "Infrastrucure Name"  
| sort -_time | stats count by IP

Now i have to show in the dashboard to show ips common to both indexes and the respective counts. So that we can see the difference of count for one ip in both the indexes.

topic Compare data between 2 indexes in Splunk Search

Compare data between 2 indexes