Comparing 2 searches using different sources?

ckutach — Thu, 09 Mar 2023 19:48:20 GMT

I am trying to make 2 searches using different indexes and sources

The first search is looking for all entries with "message sent" and the "Message Id". The second search is looking for the "Message Id" and "message sent".

I am trying to find the number of messages that were sent but not received by comparing the message ID, and list the message IDs that were not sent

Example Attempt:

(index = exampleindex1 source = examplesource1 ("message sent" AND "MessageId")  
OR (index = exampleindex2 source = examplesource2 ("message received" AND "MessageId")  
| rex field=_raw "MessageId:(?<messageId>[\S]+)\s.*" 
| stats values(*) as * by messageId

Re: Comparing 2 searches using different sources

yuanliu — Thu, 09 Mar 2023 05:20:23 GMT

Something like

(index = exampleindex1 source = examplesource1 ("message sent" AND "MessageId") ) OR (index = exampleindex2 source = examplesource2 ("message received" AND "MessageId") ) | rex field=_raw "MessageId:(?<messageId>[\S]+)\s.*" | rex "\bmessage\s+<?type>(sent|received)\b" ``` no need to specify field if _raw ``` | stats dc(messageId) as msgCount by type | eval msgCount = if(type == "received", -msgCount, msgCount) | stats sum(msgCount) as sent_not_received

You missed a couple parenthesis.

topic Comparing 2 searches using different sources? in Splunk Search

Comparing 2 searches using different sources?

Re: Comparing 2 searches using different sources