topic Re: Can I compare a field from two or more subsearches? in Splunk Search

Can I compare a field from two or more subsearches?

rune_hellem — Fri, 12 Jun 2015 12:29:15 GMT

We have three environments test, stage and prod where we run a script that creates a log file that pr. event lists name of environment, application name, buildversion for the app and the cluster it is installed to, like

12.06.2015 10:13:32,935 cellName=test applicationName=useradmin-ear buildVersion=1.7.0 clusterName=InternalCluster

My plan is to create script that creates a table in our documentation wiki showing a table with the environments as columns and applicationnames as rows the buildVersion and then mark the differences.

But then it struck me that I could save me all that work if I am able to create a search in Splunk doing this. That would be

search in indexes test,stage and prod 
find all applicationNames
where buildVersion is not equal in all indexes
show result in a table as applicationName,test.buildVersion,stage.buildVersion, prod.buildVersion

I did try to play around with the set command without to much luck so far.

set intersect [search index=stage  source="E:\\logs\allApplicationsWithDetails.log" | fields applicationName,buildVersion] [search index=test source="E:\\logs\\allApplicationsWithDetails.log" | fields applicationName,buildVersion]

well aware of the fact that this might be a long shot...

Re: Can I compare a field from two or more subsearches?

woodcock — Fri, 12 Jun 2015 14:05:48 GMT

Try this:

(index=test OR index=stage OR index=prod) source="E:\\logs\allApplicationsWithDetails.log" | stats dc(buildVersion) AS numVersions list(buildVersion) AS versions list(index) AS indices BY applicationName | where numVersions > 1

The 2 lists map value-to-value (the first value in indices goes with the first value in versions)

Re: Can I compare a field from two or more subsearches?

rune_hellem — Fri, 12 Jun 2015 14:47:59 GMT

Thanks!

That does it...saves me hours of Powershell-scripting.

Re: Can I compare a field from two or more subsearches?

woodcock — Fri, 12 Jun 2015 14:51:24 GMT

Why are you still using Powershell? I ditched it after my first use of MobaXterm.

Re: Can I compare a field from two or more subsearches?

rune_hellem — Mon, 15 Jun 2015 03:03:07 GMT

Tempting, but as it is said: "Choose your battles..." and when working in a company running Windows all over introducing something like MobaXterm is just for the few, not for the masses, so Powershell is the path of least resistance 🙂

Re: Can I compare a field from two or more subsearches?

woodcock — Mon, 15 Jun 2015 14:04:20 GMT

Powershell is for Windows people and MobaXterm is for *nix people. IMHO, if you have *nix people on staff and not providing something like MobaXterm, you hare seriously hamstringing them and cratering their productivity.