Building for the Splunk Platform

Creating a comparison report

mahbs
Path Finder

Hi,

I'm trying to create report, where I am extracting data from two different sources. This data being extracted from both sources share the same item number value. So the structure is something like this:

ITEM | src1 Field 1 | src1 Field 2 | src2 Field 1 | src2 Field 2
11111 0 0 0 0
12121 8 8 8 8
13222 7 7 7 7

Essentially, what I want to do is extract data from both sources for the relevant fields for a specific ITEM.

Can someone suggest what I can do to achieve this?

EDIT:
Apologies, I haven't been able to seperate the values for each fields. Basically, Each src field has only on Integer value.

Tags (1)
0 Karma
1 Solution

mayurr98
Super Champion

Hey

If you have different field name for both sources then try this:

source=source1 OR source=source2 ITEM=<item_number> | stats values(src1_field1) as "src1_field1"  values(src1_field2) as "src1_field2"  values(src2_field1) as "src2_field1" values(src2_field2) as "src2_field2" by ITEM 

I hope this helps you!

View solution in original post

mayurr98
Super Champion

Hey

If you have different field name for both sources then try this:

source=source1 OR source=source2 ITEM=<item_number> | stats values(src1_field1) as "src1_field1"  values(src1_field2) as "src1_field2"  values(src2_field1) as "src2_field1" values(src2_field2) as "src2_field2" by ITEM 

I hope this helps you!

mayurr98
Super Champion

Also for fast result you should write

index=export14 ITEM=$item_number$". sourcetype=csv | stats values(src1_field1) as field1 values(src1_field2) as field2 BY ITEM | rename ITEM as item_number | map search = "search index=export8 sourcetype=csv src2_item=$item_number$" | stats values(src2_field1) as field1 values(src2_field2) as field2 BY src2_item| rename src_item as item_number 
0 Karma

mahbs
Path Finder

Hi @mayurr98,

Quick question, what does ITEM= do? I understand with the others, you're displaying the values of the fields according to ITEM.

0 Karma

mahbs
Path Finder

@mayurr98,

Apologies, I should have mentioned, the fields from the two different sources will have the same name.

0 Karma

mayurr98
Super Champion

Try this then:

 index=<your_index> source=source1 ITEM=<item_number> field1=* field2=* | stats values(field1) as "src1_field1"  values(field2) as "src1_field2"  by ITEM | join ITEM [search index=<your_index> source=source2 ITEM=<item_number> field1=* field2=* | stats values(field1) as "src2_field1"  values(field2) as "src2_field2"  by ITEM] 

so your output will be
ITEM src1_field1 src1_field2 src2_field1 src2_field2
1111 0 0 0 0
2222 1 1 1 1

Let me know if this works!

0 Karma

mahbs
Path Finder

Will do! Thanks for your speedy response @mayurrr98! 🙂

0 Karma
Get Updates on the Splunk Community!

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...