Splunk Dev

Duplication of logs between sourcetype:good-audit and good-audit-admin

ngwodo
Path Finder

I have 2 major questions:

1) I have 2 Sourcetypes A and B with 2 important Fields Category and Enviroment.  I want to compare all of the Category and Environment from Sourcetype A to Sourcetype B and then return Results that are common to both sourcetype.

 

2)  I have 2 Sourcetypes A and B with 2 important Fields Category and Enviroment.  I want to compare all of the Category and Environment from Sourcetype A to Sourcetype B and then return Results that does not show up on both sourcetypes.

 

 

 

Labels (1)
0 Karma

somesoni2
Revered Legend

Try like this

For requirement 1

(index=A sourcetype=A) OR (index=B sourcetype=B)
| stats dc(sourcetype) as stCount by Category Enviroment
| where stCount=2

For requirement 2

(index=A sourcetype=A) OR (index=B sourcetype=B)
| stats dc(sourcetype) as stCount by Category Enviroment
| where stCount!=2

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It's not clear what you want the results to look like, but perhaps this will get you started.

For Question 1, we search for events with the important fields then count the sourcetypes with those fields.  The result is the set of fields where the count is 2.

index=foo (sourcetype=A OR sourcetype=B) Category=* Enviroment=*
| stats dc(sourcetype) as stCount by Category, Environment
| where stCount=2
| table Category, Environment

 

Question 2 is the inverse of Question1.  The answer may a simple inversion of the where clause or may have to be more complex, depending on the desired results.

index=foo (sourcetype=A OR sourcetype=B) Category=* Enviroment=*
| stats values(sourcetype) as sourcetypes by Category, Environment
| where mvcount(sourcetypes)<2
| table Category, Environment, sourcetypes

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...