topic Re: How to compare two results every week and display the differences from one index? in Splunk Search

How to compare two results every week and display the differences from one index?

btluynk — Thu, 05 Jan 2023 08:35:22 GMT

Hi team,

I want to compare two results every week and display the differences from one index. And I want create Jira ticket if the results are different.

Thanks

Re: How to compare two results every week and display the differences from one index?

gcusello — Thu, 05 Jan 2023 08:46:00 GMT

Hi @btluynk,

if you already created the search, please share it, otherwise, please share the sample data highlighting the fields to compare.

Ciao.

Giuseppe

Re: How to compare two results every week and display the differences from one index?

btluynk — Thu, 05 Jan 2023 08:58:15 GMT

Hi @gcusello ,

Thanks for your response, for example;

Every week this search runs and I get the results. But if the result is different, I want to create a structure like open a ticket.

Thanks

Re: How to compare two results every week and display the differences from one index?

gcusello — Thu, 05 Jan 2023 09:12:08 GMT

Hi @btluynk,

always remember that Splunk isn't a database and the join command must be used only when you haven't any other solution because it's a very slow and resource consuming command.

Let me understand: you want to find the hostname in windows and in logsource, but if you use the condition checker=0, you always have results, what do you want really find: the list of hostanems every week?

Anyway, your original search can be done using stats in this way:

(index=windows_server source=AD_Enabled_Server) OR (index=logsource source="/root/xxx/aaa.txt") | stats dc(index) AS index_count values(index) AS index BY hostname | where index_count=1 AND index=windows

If instead you want to find the hostname in windows that are also in logsource, you can use :

index=windows_server source=AD_Enabled_Server [ search index=logsource source="/root/xxx/aaa.txt") | fields hostname ]

this search has only the limit of 50,000 results in the subsearch.

Ciao.

Giuseppe