topic Re: What is the efficient way to reconcile the data from 2 indexes and create a report? in Splunk Search

What is the most efficient way to reconcile the data from 2 indexes and create a report?

iamsplunker — Tue, 02 May 2023 17:56:39 GMT

I wanted to reconcile the data from 2 indexes say index=A and index=B both indexes have some common fileds like field1,field2,field3,field4,field5

at the end I wanted to compare the data from index A and index B side by side with time span of 1s.

The report should display _time index1 index2 source field1 field2 field3 field4 field5 and difference between the 2 indexes eventcount or any other.

inventsekar — Wed, 19 Apr 2023 19:18:43 GMT

Hi,

1) is this an one time report task or you want this report to be run weekly/monthly, etc

if you want to run this report weekly/monthly, then, summary indexing (link), report acceleration(link) will help you very good.

2) how big the two indexes are..

iamsplunker — Wed, 19 Apr 2023 19:34:42 GMT

hi @inventsekar , Thanks for your response. For now it's a one time report. I'm looking for a sample search to accomplish this.

we have about ~ 3-5K events per day

iamsplunker — Tue, 02 May 2023 17:21:47 GMT

@inventsekar Do you have any examples/sample search to share for my requirement.