Splunk Dev

Duplication of logs between sourcetype:good-audit and good-audit-admin

ngwodo
Path Finder

I have 2 major questions:

1) I have 2 Sourcetypes A and B with 2 important Fields Category and Enviroment.  I want to compare all of the Category and Environment from Sourcetype A to Sourcetype B and then return Results that are common to both sourcetype.

 

2)  I have 2 Sourcetypes A and B with 2 important Fields Category and Enviroment.  I want to compare all of the Category and Environment from Sourcetype A to Sourcetype B and then return Results that does not show up on both sourcetypes.

 

 

 

Labels (1)
0 Karma

somesoni2
Revered Legend

Try like this

For requirement 1

(index=A sourcetype=A) OR (index=B sourcetype=B)
| stats dc(sourcetype) as stCount by Category Enviroment
| where stCount=2

For requirement 2

(index=A sourcetype=A) OR (index=B sourcetype=B)
| stats dc(sourcetype) as stCount by Category Enviroment
| where stCount!=2

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It's not clear what you want the results to look like, but perhaps this will get you started.

For Question 1, we search for events with the important fields then count the sourcetypes with those fields.  The result is the set of fields where the count is 2.

index=foo (sourcetype=A OR sourcetype=B) Category=* Enviroment=*
| stats dc(sourcetype) as stCount by Category, Environment
| where stCount=2
| table Category, Environment

 

Question 2 is the inverse of Question1.  The answer may a simple inversion of the where clause or may have to be more complex, depending on the desired results.

index=foo (sourcetype=A OR sourcetype=B) Category=* Enviroment=*
| stats values(sourcetype) as sourcetypes by Category, Environment
| where mvcount(sourcetypes)<2
| table Category, Environment, sourcetypes

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...