Dashboards & Visualizations

How do I compare fields in 2 different indexes and return results only if values are not matching?

spl_unker
Explorer

I would like to construct a query by comparing 2 fields (hash values) in 2 different indexes.(A&B).........

If Hash Value in Index A matches Hash value in Index B then ignore those  results else return results if hashes not matching 

 

 

0 Karma

spl_unker
Explorer

@ITWhisperer  I have updated my question.....I have removed my example for better understanding. Let me know if that is clear . TIA

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index="A" OR index="B"
| eventstats count by hash
| where count < 2
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=A OR index=B
| stats dc(index) as indexes by hostname
| where indexes < 2
0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...