Building for the Splunk Platform

It is possible if we can match every value in the table with all the values and then give the results

soundv
New Member

Hi,
i have a query on which i am stuck now from multiple days. I have combined 2 queries , first one gives the total value of eligible users and second one gives the total value of eligible users who completed the process of downloading esim profile and it is based on IMSIs values.
At the end i want the result of total number of eligible users - total number of eligible users who completed the process, not only the count but the IMSIs as well.

| fields - count] 

| table IMSI1 IMSI2
| stats count(IMSI1) as IMSI1 count(IMSI2) as IMSI2
|eval diff=IMSI1-IMSI2

it gives me count, but not the IMSIs value. It is possible if we can match single value in the table with all the values and then give the results. Something like below, then i will able to figure out the result of my final query-

Table 1 Table 2 Result
1 2 1
2 5 match
3 7 3
4 4
5 match
6 6
7 match
8 8

Tags (1)
0 Karma

woodcock
Esteemed Legend

What you have given is unclear to me. This will be almost impossible to answer unless you do the following:
Give sample events with fields labeled.
Show us a mockup of the desired final output.

0 Karma

harishalipaka
Motivator

hi @soundv

try this ..if you want sum

|makeresults |eval IMSI1="1.12,9.54,4.1,6.8,5.52,7.10"   | makemv delim="," IMSI1 | mvexpand IMSI1 | rex field=IMSI1 "(?<IMSI1>\d).(?<IMSI2>\d+)" | table IMSI1 IMSI2 
| eventstats sum(IMSI1) as sum_IMSI1,sum(IMSI2) as sum_IMSI2 |eval diff=sum_IMSI1-sum_IMSI2

Or count od IMSIs try this

|makeresults |eval IMSI1="1.12,9.54,4.1,6.8,5.52,3"   | makemv delim="," IMSI1 | mvexpand IMSI1 | rex field=IMSI1 "(?<IMSI1>\d).(?<IMSI2>\d+)" | table IMSI1 IMSI2 
| eventstats count(IMSI1) as count_IMSI1,count(IMSI2) as count_IMSI2 |eval diff=count_IMSI1-count_IMSI2
*********All the Best***********

vishaltaneja070
Motivator

Hello @soundv,

I have tried it with my data, are you looking something like this:

index=*  source="WinEventLog:Security" | stats  count by category | eval [ search index=* | stats count | rename count as count2 | return count2]  | eval Diff= count2 - count | fields - count, - count2
0 Karma

chrisyounger
SplunkTrust
SplunkTrust

are you able to provide a bit more sample data?

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...