Deployment Architecture

Compare records from two different indexes by match

New Member

Hello community,

i have two databases a and b. There are data fields which I would like to compare with each other. What does such a query look like?
Each field must be compared with each field of the database b during adjustment. Important the match must not exactli by field in index b.

Match result positiv:

Index A:

Index B:

Who can help me?

Im a beginner into the splunk world...

Thank you

Tags (1)
0 Karma


Typically, that is done like this

index=A OR index=B | stats values(*) as * by field

but that requires and exact match of 'field' in each index. So what you'll need to do is massage field into something Splunk can compare.

index=A OR index=B | eval newfield=<something that normalizes field> | stats values(*) as * by newfield

or use rex to normalize the field

index=A OR index=B | rex field=field "(?<newfield>something)" | stats values(*) as * by newfield

I'll leave the "something" up to you since only you know how to compare the data in each index.

If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...

Platform Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestIntroducing Splunk Edge Processor, simplified data ...