topic Re: Performing Set operation using splunk query in Splunk Search

Performing Set operation using splunk query

darkhorse91 — Wed, 10 Jan 2024 12:57:02 GMT

Hi ,

I have two queries, that have a common field someField

one helps me find inconsistencies:

sourcetype="my_source" someLog inconsistencies

other helps me find consistencies

sourcetype="my_source" someLog consistencies

This gives me both consistencies and inconsistencies:

sourcetype="my_source" someLog

Note that

someLog

is just a text used an identifier that's common for both the queries.

if the someField was logged as inconsistent it can be logged as consistent in the future.

How can I find those values of someField that are truly inconsistent in a given time frame, retrospectively?i.e. if currently values are inconsistent I want to be able to search (in the past or future relative to the current search) those values that are truly inconsistent - not part of the consistent results in that time frame

Re: Performing Set operation using splunk query

yuanliu — Thu, 11 Jan 2024 07:53:01 GMT

As you noted that "someLog" is just a text identifier to connect the two sets. I deduce that "consistencies" and "inconsistencies" are also mere text identifiers, not associated with a specific field.

If this is correct, your problem can be clarified as: Find values of someField that only occurs in events that contains identifier term "inconsistencies" and that do not contain identifier term "consistencies". This way, it is easy to translate into SPL:

sourcetype="my_source" someLog (consistencies OR inconsistencies) | eval consistent_or_not = if(searchmatch("consistencies"), "consistent", "inconsistent") | stats values(someField) as someField by consistent_or_not | stats values(consistent_or_not) as consistent_or_not by someField | where mvcount(consistent_or_not) < 2 AND consistent_or_not == "inconsistent"

Hope this helps.