topic Re: how to compare values from two different searches and return the results if the values are equal in Splunk Search

how to compare values from two different searches and return the results if the values are equal

manojnelakurthi — Fri, 06 Oct 2017 17:21:29 GMT

I have 2 searches
Search1:
index=i_temp source=source1
Results:
xCoord=1155276.2781774567 yCoord=1885220.7999824171
xCoord=1144751.2989115883 yCoord=1919044.2279770568

Search2:
index=i_production source=feed
Results:
xCoord=1155276.2781774567 yCoord=1885220.799982417

I want to compare both the search results and return the results if the string xCoord=1155276.2781774567 yCoord=1885220.7999824171 is same in both the searches. In reality the results for bot the searches are larger in number.

Thanks

Re: how to compare values from two different searches and return the results if the values are equal

somesoni2 — Fri, 06 Oct 2017 17:26:21 GMT

Try this (gives list of xCoord and yCoord which are common in both indexes/sources)

(index=i_temp source=*source1*)  OR (index=i_production source=*feed* )
| stats dc(index) as indexes by xCoord yCoord 
| where indexes=2

Re: how to compare values from two different searches and return the results if the values are equal

manojnelakurthi — Fri, 06 Oct 2017 18:33:49 GMT

Thanks a lot, I am getting the list, but is there any way to get the full logs because i want to check the hostname on each of the search result to check how many requests are hitting each server for the matched xCoord and yCoord as the application is deployed on 3 servers.

Re: how to compare values from two different searches and return the results if the values are equal

DalJeanis — Fri, 06 Oct 2017 21:04:59 GMT

You can do something like this...

 (index=i_temp source=*source1*)  OR (index=i_production source=*feed* )
 | eval Field1=case(index=i_production,Field1)
 | eval TempTime=case(index=i_temp,_time)
 | eval ProdTime=case(index=i_production,_time)
 | fields xCoord yCoord ProdTime TempTime ...any other fields we want to keep...
 | stats values(*) as * by xCoord yCoord

If you want a field with a particular name from one index, but not from the other, then you do something like the eval Field1 line. If you need both and you need to know which is which, then use something like the eval TempTime/prodTime lines.