topic Re: Compare value of 2 logfiles for notification in Splunk Search

How to compare value of 2 logfiles for notification?

simon9 — Wed, 23 Feb 2022 17:46:18 GMT

Hi all,

I'm a beginner working with splunk. I have 2 Logfiles with the same Name, but from 2 different Hosts. I would like to compare both file for an expression (e.g. "server disconected") and only get the result, when the same expression is in both file in the sime time-period (last 10 min.) so that i could use the select for a notification.

I hope you understand what i mean🙂

Thanks, Simon

Re: Compare value of 2 logfiles for notification

gcusello — Wed, 23 Feb 2022 15:18:28 GMT

Hi @simon9,

try something like this:

index=your_index source="yoursource" "server disconnected" | stats dc(host) AS dc_host values(host) AS host | where dc_host=1 | table host

Ciao.

Giuseppe

Re: Compare value of 2 logfiles for notification

simon9 — Wed, 23 Feb 2022 15:48:31 GMT

Ciao @gcusello

thanks for your fast response! I tried it, but i get the data also if the entrie is just in one logfile . I need a result only, if the expression "server disconnect" is in both logfile at the same time.

e.g:

Logfile from "host 1" has 10 entrys "server disconnected" and logfile from "host 2" has 2 entrys "server disconnected" in the same timeperiod -> result should be 12.

Logfile from "host 1" has 10 entrys "server disconnected" and Logfile from "host 2" has 0 entrys "server disconnected" in the same timeperiod -> result would be 0.

Thanks, Simon

Re: Compare value of 2 logfiles for notification

gcusello — Wed, 23 Feb 2022 15:57:29 GMT

Hi @simon9,

sorry, I understood exactly the opposite!

with my search you count the number of different hosts, when the count is two, means that's present in both hosts.

please, try this:

index=your_index source="yoursource" "server disconnected" | stats dc(host) AS dc_host values(host) AS host | where dc_host=2

Ciao.

Giuseppe

Re: Compare value of 2 logfiles for notification

simon9 — Wed, 23 Feb 2022 16:05:06 GMT

@gcusello you don't need to apologize, my description was not the best !

I tried the new statement, but unfortunately i still get the result, althoug just 1 logfile (Host) has entrys.

Thank you for your Help!

Re: Compare value of 2 logfiles for notification

gcusello — Wed, 23 Feb 2022 16:09:20 GMT

Hi @simon9,

you don't have results: the statistics tab is empty, you have two events from the same host,

Ciao.

Giuseppe

Re: Compare value of 2 logfiles for notification

simon9 — Wed, 23 Feb 2022 16:16:35 GMT

@gcusello OK, i understand. Grazie Mille for your help

Re: Compare value of 2 logfiles for notification

gcusello — Wed, 23 Feb 2022 16:19:00 GMT

Hi @simon9,

good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉