How to compare two searches using a shared variable?

ckutach — Fri, 03 Mar 2023 19:36:44 GMT

I am trying to make 2 searches using the same index and source.

The first search is looking for all entries with "message received" and the "Message Id". The second search is looking for the "Message Id" and "Message Type". I am trying to find the number of messages received for a specific message type.

Example:

(index = exampleindex source = examplesource ("message received" AND "MessageId")  
| rex field=_raw "MessageId:(?<messageId1>[\S]+)\s.*" 
| eval Id1 = messageId1) 
OR (index = exampleindex source = examplesource ("MessageType" AND "MessageId")  
| rex field=_raw "MessageId:(?<messageId2>[\S]+)\s.*"  
| eval Id2 = messageId2)

I want to compare the 2 searches and count how many Ids in the 1st search appear in the 2nd search

Re: Comparing 2 searches using a shared variable

richgalloway — Fri, 03 Mar 2023 19:21:44 GMT

The OR operator works within certain commands, but cannot be used to combine commands.

Use OR within the base search to fetch events with the desired data then group them by the shared field.

(index = exampleindex source = examplesource (("message received" AND "MessageId") OR ("MessageType" AND "MessageId")) | rex field=_raw "MessageId:(?<messageId>[\S]+)" ``` Combine events based on shared messageId values ``` | stats values(*) as * by messageId ``` Discard events without a MessageType ``` | where isnotnull(MessageType) | stats count by MessageType

topic How to compare two searches using a shared variable? in Splunk Search

How to compare two searches using a shared variable?

Re: Comparing 2 searches using a shared variable