topic Re: How to compare two difference sources and return events that have the same hostname in both sources? in Splunk Search

How to compare two difference sources and return events that have the same hostname in both sources?

chaseto — Mon, 08 Feb 2016 22:15:13 GMT

Hello Experts,

I have 2 different sources

source 1 has hostname, ip address
source 2 has hostname, os, os version

I want to do a comparison on both the sources and get the events which have hostname common in both the sources. How this can be done?...Thanks in advance.

Re: How to compare two difference sources and return events that have the same hostname in both sources?

bmacias84 — Mon, 08 Feb 2016 22:58:30 GMT

... | join hostname | table hostname ipaddress, osversion

Re: How to compare two difference sources and return events that have the same hostname in both sources?

somesoni2 — Mon, 08 Feb 2016 23:01:25 GMT

If you just want common host name, try this

(index=foo source=source1) OR (index=bar source=source1) | fields source hostname | stats values(source) as source by hostname | where mvcount(source)=2

(your base search for source1) | stats count by source hostname | append [ search (your base search for source2) |stats count by source hostname] | stats values(source) as source by hostname | where mvcount(source)=2

If you want to merge both the sources to show fields for common hostnames, try this

(index=foo source=source1) OR (index=bar source=source1) | fields source hostname ip_address os os_version | stats values(*) as source by hostname | where mvcount(source)=2

Re: How to compare two difference sources and return events that have the same hostname in both sources?

chaseto — Tue, 29 Sep 2020 08:42:43 GMT

Thanks somesh,will try this but In the below query of yours

(index=foo source=source1) OR (index=bar source=source1) | fields source hostname ip_address os os_version | stats values(*) as source by hostname | where mvcount(source)=2

what should I replace source and source1 in mine and in mvcount(source) ...its kinda confusing source,source1.....my sources are source1 and source2

Re: How to compare two difference sources and return events that have the same hostname in both sources?

chaseto — Tue, 29 Sep 2020 08:41:50 GMT

source1

hostname ip_address

abcq123 123.1.5.22

fwef123 109.1.1.101

source 2
hostname os os_version
abcq123 windows 10
jnknkn122 ubuntu 5

result:

hostname ip_address os os_version

abcq123 123.1.5.22 windows 10

fwef123 109.1.1.101

jnknkn122 ubuntu 5

Re: How to compare two difference sources and return events that have the same hostname in both sources?

somesoni2 — Tue, 09 Feb 2016 04:45:27 GMT

Ok.. What are your queries to get data from both the sources?

Re: How to compare two difference sources and return events that have the same hostname in both sources?

chaseto — Tue, 09 Feb 2016 16:55:31 GMT

ya need the records from both sources

Re: How to compare two difference sources and return events that have the same hostname in both sources?

somesoni2 — Tue, 09 Feb 2016 18:07:32 GMT

No, what is the query that you write to get result from the source?

Re: How to compare two difference sources and return events that have the same hostname in both sources?

chaseto — Tue, 09 Feb 2016 18:56:49 GMT

index=abc source=source1 |join hostname [index=abc source=source2]|table hostname,ipaddress,os,os_version