Reporting

Query on get Combined and Unique Values

Mallik657
Explorer

Hi,

I have  database1 and database2,  I have query1 to get the data from database1 and query2 to get data from database2. query3 to get unique values from databse2 which doesn't exist in database1.

Now my requirement is to combine the common values in both the databases using a query1 & query2 and also unique values from query2 from database2 which doesn't exist in database1.

Please provide me the Splunk query.

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please share your current searches and some sample events, and what your expected result would look like (anonymised of course)

0 Karma

Mallik657
Explorer

Result should get common in both databases and also unique/rest values from database2. Please help me with query.

Databse1Database2Result
AAA
BBB
CCC
EE
EFF
 GG
 HH
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults count=5
| fields - _time
| streamstats count as row
| eval database1=mvindex(split("ABCDE",""),row - 1)
| fields - row
| appendcols
    [| makeresults count=7
    | streamstats count as row
    | eval database2=mvindex(split("ABCEFGH",""),row - 1)
    | fields - row]
| eval result=database2
0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...