Reporting

Query on get Combined and Unique Values

Mallik657
Explorer

Hi,

I have  database1 and database2,  I have query1 to get the data from database1 and query2 to get data from database2. query3 to get unique values from databse2 which doesn't exist in database1.

Now my requirement is to combine the common values in both the databases using a query1 & query2 and also unique values from query2 from database2 which doesn't exist in database1.

Please provide me the Splunk query.

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please share your current searches and some sample events, and what your expected result would look like (anonymised of course)

0 Karma

Mallik657
Explorer

Result should get common in both databases and also unique/rest values from database2. Please help me with query.

Databse1Database2Result
AAA
BBB
CCC
EE
EFF
 GG
 HH
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults count=5
| fields - _time
| streamstats count as row
| eval database1=mvindex(split("ABCDE",""),row - 1)
| fields - row
| appendcols
    [| makeresults count=7
    | streamstats count as row
    | eval database2=mvindex(split("ABCEFGH",""),row - 1)
    | fields - row]
| eval result=database2
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...