topic Re: How to compare output of two splunk queries where nothing is common in Splunk Search

How to compare output of two splunk queries where nothing is common

Emily12 — Wed, 21 Oct 2020 15:22:07 GMT

Hi Everyone

I have 2 queries

1) mysearchquery | table xyz

2) mysearchquery| table abc

And these two queries does not have anything common

I need to compare xyz and abc in a single query

How can I do that.

Thank you in advance

Re: How to compare output of two splunk queries where nothing is common

ITWhisperer — Wed, 21 Oct 2020 15:28:07 GMT

Hi @Emily12

If the two tables have nothing in common, what criteria are you going to use to compare them?

Re: How to compare output of two splunk queries where nothing is common

Emily12 — Wed, 21 Oct 2020 15:31:49 GMT

Hi @ITWhisperer

Xyz and abc will return some integer value to me so I will compare like if xyz=abc

Re: How to compare output of two splunk queries where nothing is common

Emily12 — Wed, 21 Oct 2020 15:33:56 GMT

@ITWhisperer basically I want to know how to join the search query result of 2 queries

Re: How to compare output of two splunk queries where nothing is common

ITWhisperer — Wed, 21 Oct 2020 15:54:22 GMT

mysearchquery | table xyz | join type=left [ mysearchquery | table abc ]

Note that subsearches are limited by the number of events so if you can combine your two searches into one to do your calculations for xyz and abc it might be better

Re: How to compare output of two splunk queries where nothing is common

danspav — Thu, 22 Oct 2020 05:17:19 GMT

If you are trying to add two numbers from two different searches it's highly likely you can do that in one search using stats.

Are you able to share more about each search?

Otherwise, you can do an append to combine the two outputs with something like:

This search gets your first number, abc, then appends the second number, xyz.
Then we run stats to get them on one row, and finally do a simple eval for the total.

You could then use this result in a single value visualization on a dashboard.

But as I mentioned, you can probably get both totals using stats. See docs for more info.