Dashboards & Visualizations

How do I compare fields in 2 different indexes and return results only if values are not matching?

spl_unker
Explorer

I would like to construct a query by comparing 2 fields (hash values) in 2 different indexes.(A&B).........

If Hash Value in Index A matches Hash value in Index B then ignore those  results else return results if hashes not matching 

 

 

0 Karma

spl_unker
Explorer

@ITWhisperer  I have updated my question.....I have removed my example for better understanding. Let me know if that is clear . TIA

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index="A" OR index="B"
| eventstats count by hash
| where count < 2
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=A OR index=B
| stats dc(index) as indexes by hostname
| where indexes < 2
0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...