I read through the splunk answers I could find, but I did not find an answer that was helped me with what I need. I attempted using joins, appends, appendcols, stats, etc but could not find the correct way to do this that was not resource intensive. The search below works, but I can't get it to compare the values properly.
I have email addresses on a mail server which sends emails for multiple applications and therefore has a very large volume of data (index=mail host=mailserver). I also have a smaller application that is a dbconnect index which sends emails out through the SMTP server. My goal is to create alerts to let me know if the application created an email but the mail server did not receive or send it out, so I need to compare the two values.
This also works, but it appears very inefficient: (also for a reason I dont understand the "NOT" matches, while leaving it out does not match..)
Is there a better way? Again I just need to know when it the field exists in one and not the other. Also I need to know within a period of time, say if the email is not processed by the SMTP server within 30 minutes.