Dashboards & Visualizations

Combine results of 2 searches to perform math on results

tkwaller_2
Communicator

Hello

 

I have 2 searches that i want to do math on the results. Each search looks for a specific string and dedups based on an id. 

The first search:

 

 

index=anon_index source="*source.log"  "call to ODM at */file_routing"
| dedup MSGID
| stats count

 

 

the second search:

 

 

index=anon_index source="*source.log" "message was published to * successfully"
| dedup MSGID
| append [search index="index2"  "ROUTING failed.  Result sent to * response queue  tjhis.MSG.RES.xxx" source=MSGTBL* OR source=MSG_RESPONSE OR source=*source.log
| dedup MSGID]
| stats count

 

 

What I'd like to be able to do is take the results from the first set and subtract the second. for example if the first set was 1000 and the second was 500 I'd like to be able to show the difference. At some point I'd like to be able to show the id's that were in the first set that were not in the second and show that in a panel.


Thanks for the assistance!

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

index=anon_index source="*source.log" "message was published to * successfully"
| dedup MSGID
| append [search index="index2"  "ROUTING failed.  Result sent to * response queue  tjhis.MSG.RES.xxx" source=MSGTBL* OR source=MSG_RESPONSE OR source=*source.log
| dedup MSGID]
| stats count as firstcount
| appendcols
[ search index=anon_index source="*source.log"  "call to ODM at */file_routing"
| dedup MSGID
| stats count as secondcount]
| eval diff=firstcount-secondcount

View solution in original post

tkwaller_2
Communicator

worked great, thanks!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

index=anon_index source="*source.log" "message was published to * successfully"
| dedup MSGID
| append [search index="index2"  "ROUTING failed.  Result sent to * response queue  tjhis.MSG.RES.xxx" source=MSGTBL* OR source=MSG_RESPONSE OR source=*source.log
| dedup MSGID]
| stats count as firstcount
| appendcols
[ search index=anon_index source="*source.log"  "call to ODM at */file_routing"
| dedup MSGID
| stats count as secondcount]
| eval diff=firstcount-secondcount
Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf24, and Community Connections

Thank you to everyone in the Splunk Community who joined us for .conf24 – starting with Splunk University and ...

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...