Splunk Dev

Duplication of logs between sourcetype:good-audit and good-audit-admin

ngwodo
Path Finder

I have 2 major questions:

1) I have 2 Sourcetypes A and B with 2 important Fields Category and Enviroment.  I want to compare all of the Category and Environment from Sourcetype A to Sourcetype B and then return Results that are common to both sourcetype.

 

2)  I have 2 Sourcetypes A and B with 2 important Fields Category and Enviroment.  I want to compare all of the Category and Environment from Sourcetype A to Sourcetype B and then return Results that does not show up on both sourcetypes.

 

 

 

Labels (1)
0 Karma

somesoni2
Revered Legend

Try like this

For requirement 1

(index=A sourcetype=A) OR (index=B sourcetype=B)
| stats dc(sourcetype) as stCount by Category Enviroment
| where stCount=2

For requirement 2

(index=A sourcetype=A) OR (index=B sourcetype=B)
| stats dc(sourcetype) as stCount by Category Enviroment
| where stCount!=2

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It's not clear what you want the results to look like, but perhaps this will get you started.

For Question 1, we search for events with the important fields then count the sourcetypes with those fields.  The result is the set of fields where the count is 2.

index=foo (sourcetype=A OR sourcetype=B) Category=* Enviroment=*
| stats dc(sourcetype) as stCount by Category, Environment
| where stCount=2
| table Category, Environment

 

Question 2 is the inverse of Question1.  The answer may a simple inversion of the where clause or may have to be more complex, depending on the desired results.

index=foo (sourcetype=A OR sourcetype=B) Category=* Enviroment=*
| stats values(sourcetype) as sourcetypes by Category, Environment
| where mvcount(sourcetypes)<2
| table Category, Environment, sourcetypes

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...