Splunk Search

Problem with set command

megancarney
Explorer

I'm trying to get use the set command to monitor differences between two sets of DNS records.

I've looked through the documentation and previous questions on the topic and still can't make it work.

This search has 10 results:

index=dns_processed earliest=-8d | top Hostname | fields Hostname

This search has 49 results:

index=dns_processed earliest=-8d | fields Hostname

But for some reason, this search has 0 results:

set union [search index=dns_processed earliest=-8d | top Hostname | fields Hostname] [search index=dns_processed earliest=-8d | fields Hostname]

Any hints?

Tags (2)
0 Karma

megancarney
Explorer

Okay, the problem was stupid-simple. The set command needs a pipe before it or splunk doesn't interpret 'set' as a command.

So:
| set union [search index=dns_processed earliest=-8d | top Hostname | fields Hostname] [search index=dns_processed earliest=-8d | fields Hostname]

Ayn
Legend

It's been a while since I've used set now, but from what I recall I had similar problems which in the end were due to that internal fields such as _time were implicitly returned from the subsearches. So the sets being compared didn't just consist of the field I wanted to check (which in your case would be Hostname), but also of timestamps and various other stuff. I solved it by adding | fields -_* at the end of my subsearches. Let me know if this is the problem you're running into as well.

0 Karma

megancarney
Explorer

Didn't help. 😞

0 Karma
Get Updates on the Splunk Community!

Security Professional: Sharpen Your Defenses with These .conf25 Sessions

Sooooooooooo, guess what. .conf25 is almost here, and if you're on the Security Learning Path, this is your ...

First Steps with Splunk SOAR

Our first step was to gather a list of the playbooks we wanted and to sort them by priority.  Once this list ...

How To Build a Self-Service Observability Practice with Splunk Observability Cloud

If you’ve read our previous post on self-service observability, you already know what it is and why it ...