topic Re: Comparison in Splunk Search

How to extract, if log1 - severity =6 then what is the severity in log2, at given point of time?

VijayA — Tue, 04 Apr 2023 10:51:06 GMT

Hi All,

I'm searching 2 different logs, which contain the "Severity" as common field.

I want to extract, if log1 - severity =6 then what is the severity in log2, at given point of time.

Severity values will be 1-6 only

Ex:

Log1 Log2

Severity 6 3

Kindly help on the same...

Thank you

Re: Comparison

ITWhisperer — Tue, 04 Apr 2023 10:11:44 GMT

What do you mean by "at given point of time"?

Assuming you already have the logs ingested into Splunk, there are most likely stored as a series of events. Hopefully, these events will have a timestamp which is extracted and tagged to event. Splunk can then process these events in a pipeline of events returned by a search. It is essentially processing one event at a time. In order to compare values from more than one event, they have to be brought together (often by a stats command), so that these stats events can be processed (one at a time).

How do you want to bring your events from the two logs together?

Re: Comparison

VijayA — Tue, 04 Apr 2023 10:21:20 GMT

Hi,

I already have logs in splunk from both log1 and log2 as events, they have timestamps as well

I do have 4 other fields in common and using JOIN to combine the fields.

but I'm unable to compare the if S=6 in Log1, what is the S value in Log2

Please provide some comparison steps.

Re: Comparison

ITWhisperer — Tue, 04 Apr 2023 10:30:34 GMT

You haven't answered the central question - what do you mean by "given point of time"?

Re: Comparison

VijayA — Tue, 04 Apr 2023 10:35:08 GMT

"given point of time" means

ex: on 04/04/23 10:04:05 AM if log1 S=6, what is value of S in log2 at the same time.

Log1 Log2

Severity 6 3

Re: Comparison

ITWhisperer — Tue, 04 Apr 2023 11:05:34 GMT

So, if you have an event in log 1 at 04/04/23 10:04:05 AM, are you expecting there to be an event in log 2 at exactly the same time? Down the second, or even millisecond?

Re: Comparison

VijayA — Tue, 04 Apr 2023 11:34:23 GMT

Yes, Down the second, will be good

Re: Comparison

ITWhisperer — Tue, 04 Apr 2023 12:26:40 GMT

This may not give you what you want, but might be close to what you have asked for

| bin _time span=1s | chart latest(severity) by _time log