Getting Data In

How do I compare the count of the same field from different sources?

WXY
Path Finder

Hi,

Now I have a problem:

I have a index data which has multiple sources and they have the same sourcetype.

index=t_web sourcetype=t_web_pect

source such as :
t_we_a1.txt ,t_we_a2.txt , t_we_a3.txt
They have the same fields, because of source type fields such as: scan_system_name scan_level.

Different sources may have the same scan_system_name
now I want to get a table ,such as :

sys_Name  number of recent scan_level   number of recent scan_level   Compared with the last scan 
name1         66                            60                       More than the last one
name2          57                           68                       Fewer than the last one
name3          34                           34                      The number has't changed

name1 may in multiple sources. I just need to get the same system name.

What should I do?

Tags (2)
0 Karma
1 Solution

WXY
Path Finder

I have solved this problem:

index=t_web
| stats count(scan_level) as levelcount by scan_system_name  _time 
| streamstats latest(levelcount) as a by scan_system_name  current=f 
| fillnull value=0 a 
| eval aa = levelcount-a 
| stats latest(_time) as _time latest(a) as lastCount latest(levelcount) as finalScan  count as scanCount latest(aa) as ComparedWithLast by scan_system_name
| eval ComparedWithLast  = CASE ( 'scanCount'==1, "Only Scan One", ('scanCount'>1 and 'ComparedWithLast'>0), "More than the last one", 'ComparedWithLast'<0, "Fewer than the last one", ('scanCount'>1 and 'ComparedWithLast'==0), "The number has't changed")

View solution in original post

0 Karma

WXY
Path Finder

I have solved this problem:

index=t_web
| stats count(scan_level) as levelcount by scan_system_name  _time 
| streamstats latest(levelcount) as a by scan_system_name  current=f 
| fillnull value=0 a 
| eval aa = levelcount-a 
| stats latest(_time) as _time latest(a) as lastCount latest(levelcount) as finalScan  count as scanCount latest(aa) as ComparedWithLast by scan_system_name
| eval ComparedWithLast  = CASE ( 'scanCount'==1, "Only Scan One", ('scanCount'>1 and 'ComparedWithLast'>0), "More than the last one", 'ComparedWithLast'<0, "Fewer than the last one", ('scanCount'>1 and 'ComparedWithLast'==0), "The number has't changed")
0 Karma

woodcock
Esteemed Legend

I do not understand your situation. If you will give a small set of sample data and the desired output (perhaps with commentary on how the normal way of doing it would give the wrong output and show the wrong output), then I will try to help.

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

hi @WXY

Are you still having trouble with this issue? If so, please answer the commenter above so that they can help you further. There is also an answer below — did you try out their solution? Or, if you solved your query on your own, please describe the steps you took so that others can learn from your solution.

Thanks.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Use some conditional logic like this

| eval count_source_one=if(SOURCE1=source1, 'count',"")
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...