Building for the Splunk Platform

Duplication of logs between sourcetype:good-audit and good-audit-admin

ngwodo
Path Finder

I have 2 major questions:

1) I have 2 Sourcetypes A and B with 2 important Fields Category and Enviroment.  I want to compare all of the Category and Environment from Sourcetype A to Sourcetype B and then return Results that are common to both sourcetype.

 

2)  I have 2 Sourcetypes A and B with 2 important Fields Category and Enviroment.  I want to compare all of the Category and Environment from Sourcetype A to Sourcetype B and then return Results that does not show up on both sourcetypes.

 

 

 

Labels (1)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try like this

For requirement 1

(index=A sourcetype=A) OR (index=B sourcetype=B)
| stats dc(sourcetype) as stCount by Category Enviroment
| where stCount=2

For requirement 2

(index=A sourcetype=A) OR (index=B sourcetype=B)
| stats dc(sourcetype) as stCount by Category Enviroment
| where stCount!=2

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It's not clear what you want the results to look like, but perhaps this will get you started.

For Question 1, we search for events with the important fields then count the sourcetypes with those fields.  The result is the set of fields where the count is 2.

index=foo (sourcetype=A OR sourcetype=B) Category=* Enviroment=*
| stats dc(sourcetype) as stCount by Category, Environment
| where stCount=2
| table Category, Environment

 

Question 2 is the inverse of Question1.  The answer may a simple inversion of the where clause or may have to be more complex, depending on the desired results.

index=foo (sourcetype=A OR sourcetype=B) Category=* Enviroment=*
| stats values(sourcetype) as sourcetypes by Category, Environment
| where mvcount(sourcetypes)<2
| table Category, Environment, sourcetypes

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...

Starting With Observability: OpenTelemetry Best Practices

Tech Talk Starting With Observability: OpenTelemetry Best Practices Tuesday, October 17, 2023   |  11AM PST / ...