Getting Data In

Is it possible to do a Splunk query that can give me difference in values?

AruBhende
Explorer

We have ingested into Splunk logs from our application - these logs include two keys - stageType  and correlation id, along with other keys.    I have to find a list of correlation ids that are returned for one stageType and not for other stageType.   I realise Splunk queries cannot be written similar to SQL I am not very conversant with Splunk -  I just normally get by - using simpler queries.  

Hence hoping, someone can help me with a query that gives me the list - so I can do further analysis to find out the reason for differences, which should not normally exist.

Is it possible to do it in Splunk? Can someone help me with the query?

index=grp-applications sourcetype="kafka:status" stageType IN ("STAGEA", "STAGEB" )  env=qa | dedup env, correlationId, stageType | stats count by env, correlationId, stageType

Thank you

 

Labels (2)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @AruBhende,

Please try below;

index=grp-applications sourcetype="kafka:status" stageType IN ("STAGEA", "STAGEB" ) env=qa 
| stats values(stageType) as stageType by env correlationId 
| where mvcount(stageType) = 1

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @AruBhende,

If you see all correlation ids, they should be different between stages. Can you paste a sample log containing both stages?

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

AruBhende
Explorer

Sorry, it was a mistake on my part.  It should have been sourceCorrelationId instead of correlationId.  Both are valid keys in the log. When I used sourceCorrs a am accepting that elationId in the example you provided, it worked.

I am accepting that as solution.

Thanks for your help.

 

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @AruBhende,

Please try below;

index=grp-applications sourcetype="kafka:status" stageType IN ("STAGEA", "STAGEB" ) env=qa 
| stats values(stageType) as stageType by env correlationId 
| where mvcount(stageType) = 1

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

AruBhende
Explorer

Hi,

I tried it but it is not giving the difference, it is giving all the correlation ids.  For STAGEA, there are about 55000 events returned and for STAGEB, about 50000.  The above query is returning 105,000 events, whereas I want to get only the 5000 - which is the difference.  Is it possible ?

Thanks

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...