topic Problem with set command in Splunk Search

Problem with set command

megancarney — Mon, 28 Sep 2020 12:55:21 GMT

I'm trying to get use the set command to monitor differences between two sets of DNS records.

I've looked through the documentation and previous questions on the topic and still can't make it work.

This search has 10 results:

index=dns_processed earliest=-8d | top Hostname | fields Hostname

This search has 49 results:

index=dns_processed earliest=-8d | fields Hostname

But for some reason, this search has 0 results:

set union [search index=dns_processed earliest=-8d | top Hostname | fields Hostname] [search index=dns_processed earliest=-8d | fields Hostname]

Any hints?

Re: Problem with set command

Ayn — Thu, 06 Dec 2012 18:07:59 GMT

It's been a while since I've used set now, but from what I recall I had similar problems which in the end were due to that internal fields such as _time were implicitly returned from the subsearches. So the sets being compared didn't just consist of the field I wanted to check (which in your case would be Hostname), but also of timestamps and various other stuff. I solved it by adding | fields -_* at the end of my subsearches. Let me know if this is the problem you're running into as well.

Re: Problem with set command

megancarney — Thu, 06 Dec 2012 19:02:00 GMT

Didn't help. 😞

Re: Problem with set command

megancarney — Mon, 28 Sep 2020 12:58:37 GMT

Okay, the problem was stupid-simple. The set command needs a pipe before it or splunk doesn't interpret 'set' as a command.

So:
| set union [search index=dns_processed earliest=-8d | top Hostname | fields Hostname] [search index=dns_processed earliest=-8d | fields Hostname]