Building for the Splunk Platform

Duplication of logs between sourcetype:good-audit and good-audit-admin

ngwodo
Path Finder

I have 2 major questions:

1) I have 2 Sourcetypes A and B with 2 important Fields Category and Enviroment.  I want to compare all of the Category and Environment from Sourcetype A to Sourcetype B and then return Results that are common to both sourcetype.

 

2)  I have 2 Sourcetypes A and B with 2 important Fields Category and Enviroment.  I want to compare all of the Category and Environment from Sourcetype A to Sourcetype B and then return Results that does not show up on both sourcetypes.

 

 

 

Labels (1)
0 Karma

somesoni2
Revered Legend

Try like this

For requirement 1

(index=A sourcetype=A) OR (index=B sourcetype=B)
| stats dc(sourcetype) as stCount by Category Enviroment
| where stCount=2

For requirement 2

(index=A sourcetype=A) OR (index=B sourcetype=B)
| stats dc(sourcetype) as stCount by Category Enviroment
| where stCount!=2

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It's not clear what you want the results to look like, but perhaps this will get you started.

For Question 1, we search for events with the important fields then count the sourcetypes with those fields.  The result is the set of fields where the count is 2.

index=foo (sourcetype=A OR sourcetype=B) Category=* Enviroment=*
| stats dc(sourcetype) as stCount by Category, Environment
| where stCount=2
| table Category, Environment

 

Question 2 is the inverse of Question1.  The answer may a simple inversion of the where clause or may have to be more complex, depending on the desired results.

index=foo (sourcetype=A OR sourcetype=B) Category=* Enviroment=*
| stats values(sourcetype) as sourcetypes by Category, Environment
| where mvcount(sourcetypes)<2
| table Category, Environment, sourcetypes

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...