Dashboards & Visualizations

Finding a intersect between n fields using multisearch

cindygibbs_08
Communicator
Hello guys

I was thinking if it was possible to perhaps find the common and uncommon values between n fields after using a multisearch command, I cant seem to find a function in Splunk to yield the intersect between values, or is there one?

Lets say that my code looks like this:

 

|multisearch 
[|search index=BOOK
| fields A]
[|search index=FLIGHT
| fields B]
[|search index=HOTEL
| fields C]​

A,B and C are IDs from different custumers and I´d like to know what are the common costumers between the three fields and also the costumers that are exclusive to each field (that means that their ID only apprears in either field A, B or C )

-Please dont judge me 😞

 

I started by using the stats command and do something like
| stats values(A) as A values(B) as B and values(C) as C 
but since there is no other field to do something like " by clause" I was even able to have the info in a table, any information or documentation is so welcome thank you so much guys

kindly,
 
Cindy
Labels (1)
Tags (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

If I understand correctly, you want to get the types of bookings by customer id and identify where there are common bookings by the same customer or only single bookings.

So, the base search, assuming A, B and C represent the customer Id in the data from each index, is

index=BOOK OR index=flight OR index=hotel
| eval customerId=coalesce(A,B,C)
| stats dc(index) as types values(index) as indexes by customerId

You can then do

| where types=1

to find the customers with only one booking type and 

| where types=3

to identify all 3.

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

If I understand correctly, you want to get the types of bookings by customer id and identify where there are common bookings by the same customer or only single bookings.

So, the base search, assuming A, B and C represent the customer Id in the data from each index, is

index=BOOK OR index=flight OR index=hotel
| eval customerId=coalesce(A,B,C)
| stats dc(index) as types values(index) as indexes by customerId

You can then do

| where types=1

to find the customers with only one booking type and 

| where types=3

to identify all 3.

 

cindygibbs_08
Communicator

thank so much!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...