Dashboards & Visualizations

Combine results of 2 searches to perform math on results

tkwaller_2
Communicator

Hello

 

I have 2 searches that i want to do math on the results. Each search looks for a specific string and dedups based on an id. 

The first search:

 

 

index=anon_index source="*source.log"  "call to ODM at */file_routing"
| dedup MSGID
| stats count

 

 

the second search:

 

 

index=anon_index source="*source.log" "message was published to * successfully"
| dedup MSGID
| append [search index="index2"  "ROUTING failed.  Result sent to * response queue  tjhis.MSG.RES.xxx" source=MSGTBL* OR source=MSG_RESPONSE OR source=*source.log
| dedup MSGID]
| stats count

 

 

What I'd like to be able to do is take the results from the first set and subtract the second. for example if the first set was 1000 and the second was 500 I'd like to be able to show the difference. At some point I'd like to be able to show the id's that were in the first set that were not in the second and show that in a panel.


Thanks for the assistance!

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

index=anon_index source="*source.log" "message was published to * successfully"
| dedup MSGID
| append [search index="index2"  "ROUTING failed.  Result sent to * response queue  tjhis.MSG.RES.xxx" source=MSGTBL* OR source=MSG_RESPONSE OR source=*source.log
| dedup MSGID]
| stats count as firstcount
| appendcols
[ search index=anon_index source="*source.log"  "call to ODM at */file_routing"
| dedup MSGID
| stats count as secondcount]
| eval diff=firstcount-secondcount

View solution in original post

tkwaller_2
Communicator

worked great, thanks!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

index=anon_index source="*source.log" "message was published to * successfully"
| dedup MSGID
| append [search index="index2"  "ROUTING failed.  Result sent to * response queue  tjhis.MSG.RES.xxx" source=MSGTBL* OR source=MSG_RESPONSE OR source=*source.log
| dedup MSGID]
| stats count as firstcount
| appendcols
[ search index=anon_index source="*source.log"  "call to ODM at */file_routing"
| dedup MSGID
| stats count as secondcount]
| eval diff=firstcount-secondcount
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...