Deployment Architecture

Compare records from two different indexes by match

New Member

Hello community,

i have two databases a and b. There are data fields which I would like to compare with each other. What does such a query look like?
Each field must be compared with each field of the database b during adjustment. Important the match must not exactli by field in index b.

Match result positiv:

Index A:

Index B:

Who can help me?

Im a beginner into the splunk world...

Thank you

Tags (1)
0 Karma


Typically, that is done like this

index=A OR index=B | stats values(*) as * by field

but that requires and exact match of 'field' in each index. So what you'll need to do is massage field into something Splunk can compare.

index=A OR index=B | eval newfield=<something that normalizes field> | stats values(*) as * by newfield

or use rex to normalize the field

index=A OR index=B | rex field=field "(?<newfield>something)" | stats values(*) as * by newfield

I'll leave the "something" up to you since only you know how to compare the data in each index.

If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...