Dashboards & Visualizations

Finding a intersect between n fields using multisearch

cindygibbs_08
Communicator
Hello guys

I was thinking if it was possible to perhaps find the common and uncommon values between n fields after using a multisearch command, I cant seem to find a function in Splunk to yield the intersect between values, or is there one?

Lets say that my code looks like this:

 

|multisearch 
[|search index=BOOK
| fields A]
[|search index=FLIGHT
| fields B]
[|search index=HOTEL
| fields C]​

A,B and C are IDs from different custumers and I´d like to know what are the common costumers between the three fields and also the costumers that are exclusive to each field (that means that their ID only apprears in either field A, B or C )

-Please dont judge me 😞

 

I started by using the stats command and do something like
| stats values(A) as A values(B) as B and values(C) as C 
but since there is no other field to do something like " by clause" I was even able to have the info in a table, any information or documentation is so welcome thank you so much guys

kindly,
 
Cindy
Tags (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

If I understand correctly, you want to get the types of bookings by customer id and identify where there are common bookings by the same customer or only single bookings.

So, the base search, assuming A, B and C represent the customer Id in the data from each index, is

index=BOOK OR index=flight OR index=hotel
| eval customerId=coalesce(A,B,C)
| stats dc(index) as types values(index) as indexes by customerId

You can then do

| where types=1

to find the customers with only one booking type and 

| where types=3

to identify all 3.

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

If I understand correctly, you want to get the types of bookings by customer id and identify where there are common bookings by the same customer or only single bookings.

So, the base search, assuming A, B and C represent the customer Id in the data from each index, is

index=BOOK OR index=flight OR index=hotel
| eval customerId=coalesce(A,B,C)
| stats dc(index) as types values(index) as indexes by customerId

You can then do

| where types=1

to find the customers with only one booking type and 

| where types=3

to identify all 3.

 

cindygibbs_08
Communicator

thank so much!

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...