Is it possible to do a Splunk query that can give me difference in values?

[AruBhende]

We have ingested into Splunk logs from our application - these logs include two keys - stageType  and correlation id, along with other keys.    I have to find a list of correlation ids that are returned for one stageType and not for other stageType.   I realise Splunk queries cannot be written similar to SQL I am not very conversant with Splunk -  I just normally get by - using simpler queries.  

Hence hoping, someone can help me with a query that gives me the list - so I can do further analysis to find out the reason for differences, which should not normally exist.

Is it possible to do it in Splunk? Can someone help me with the query?

index=grp-applications sourcetype="kafka:status" stageType IN ("STAGEA", "STAGEB" )  env=qa | dedup env, correlationId, stageType | stats count by env, correlationId, stageType

Thank you

[scelikok]

Hi @AruBhende,

If you see all correlation ids, they should be different between stages. Can you paste a sample log containing both stages?

[AruBhende]

Sorry, it was a mistake on my part.  It should have been sourceCorrelationId instead of correlationId.  Both are valid keys in the log. When I used sourceCorrs a am accepting that elationId in the example you provided, it worked.

I am accepting that as solution.

Thanks for your help.

[scelikok · Accepted solution]

Hi @AruBhende,

Please try below;

index=grp-applications sourcetype="kafka:status" stageType IN ("STAGEA", "STAGEB" ) env=qa 
| stats values(stageType) as stageType by env correlationId 
| where mvcount(stageType) = 1

[AruBhende]

Hi,

I tried it but it is not giving the difference, it is giving all the correlation ids.  For STAGEA, there are about 55000 events returned and for STAGEB, about 50000.  The above query is returning 105,000 events, whereas I want to get only the 5000 - which is the difference.  Is it possible ?

Thanks