topic How can I count same field from different sourcetypes? in Splunk Search

How can I count same field from different sourcetypes?

Mike6960 — Wed, 04 Apr 2018 14:30:20 GMT

I have two sourcetypes. In both, there is a field present that has the same value in both but just another name, let's say Field1 en Field1a
Normally each value is present in both. This can be more than once but then also in both. Sometimes the value is only present in 1 of the sourcetypes. I want to determine when this happens. I thought it would be easy by just counting the number of each value in both sources and when the two counts are different I would know. But somehow I am not able to do a count of them both, someone ideas?

Re: How can I count same field from different sourcetypes?

davpx — Thu, 05 Apr 2018 00:18:37 GMT

Does something like this help?

index=blah sourcetype=sourcetypeA OR sourcetype=sourcetypeB | stats count(my_field) as count by sourcetype

Re: How can I count same field from different sourcetypes?

Mike6960 — Thu, 05 Apr 2018 06:19:48 GMT

Thanks, but the 'my field' has a different name in both sourcetypes so I can't count by just one field

Re: How can I count same field from different sourcetypes?

niketn — Thu, 05 Apr 2018 06:30:51 GMT

@Mike6960, you would need to create a Field Alias Knowledge Object for one of the sourcetype to make both the fields names as same lets say Field1.

If you are creating a Field Alias For sourcetype B will have effect similar to following command eval Field1=Field1a
If you want to do something similar in your Splunk Query you can try the following:

index=blah sourcetype=sourcetypeA OR sourcetype=sourcetypeB 
| rename  Field1a as Field1
| stats count by sourcetype Field1

Re: How can I count same field from different sourcetypes?

Mike6960 — Thu, 05 Apr 2018 06:46:55 GMT

Hi @niketnilay,
I've created a fieldalias and I use chart count by sourcetype 'and' Field1. I almost have the result I want. The result is now a table which shows which shows the Field1 and how many times its exists in each sourcetype. Now I want to see only the results where the counts are not equal....?

Re: How can I count same field from different sourcetypes?

niketn — Thu, 05 Apr 2018 08:22:08 GMT

Instead of stats use chart,

  <YourBaseSearch>
  | chart count by Field1 sourcetype 
  | search sourcetypeA!=sourcetypeB

  <YourBaseSearch>
 | chart count over Field1 by sourcetype 
  | search sourcetypeA!=sourcetypeB

Re: How can I count same field from different sourcetypes?

Mike6960 — Tue, 29 Sep 2020 18:52:44 GMT

@niketn , I produced this :
Fieldalias for B_C and B_X is B_C_X

| eval B_C_X =ltrim(tostring(B_C_X ),"0")
| chart count(B_C) as T count(B_X) as T2 by B_C_X

| where T!= T2
| fillnull

if I use 'search' instead of 'where' I still get mutiple rows with all the results. Now I only need to figure out how to show the sourcetype in the result