Splunk Dev

how to compare two search results and display only missing values in one searched result respect to other

kmmanikandan
Explorer

i have two set of result which give AVC_ID and what i want is compare these two set of result and only display missing AVC_ID with respect to the each searched results.

like search result1
AVC1
AVC2
AVC3

search result 2
AVC1
AVC3
AVC4

expecting output
1. missed value in search result 1 with respect to search result 2
AVC4
2. missed value in search result 2 with respect to search result 1
AVC2

i tried below query and getting error:

search 1:
eventtype="li_specific" |eval (AVC_ID=case(searchmatch("AVC*"),"AVC*") |dedup AVC_ID,_time |append [search eventtype="hfc" |eval (AVC_ID=case(searchmatch("AVC*"),"AVC*") |dedup AVC_ID,_time ] |table AVC_ID
search 2:
eventtype="ne_config" |eval (AVC_ID=case(searchmatch("AVC*"),"AVC*") |dedup AVC_ID,_time |table AVC_ID

comparison query:
eventtype="li_specific" |eval (AVC_ID=case(searchmatch("AVC*"),"AVC*") |dedup AVC_ID,_time |append [search eventtype="hfc" |eval (AVC_ID=case(searchmatch("AVC*"),"AVC*") |dedup AVC_ID,_time ] NOT ([search eventtype="ne_config" |eval (AVC_ID=case(searchmatch("AVC*"),"AVC*") |dedup AVC_ID,_time |table AVC_ID |rename AVC_ID as "avc missing in ne config"])

error which i got while running comparison search:
: Error in 'append' command: The last argument must be a subsearch

could you please help me how to achieve this.

Thanks in Advance.

Mani

Tags (1)

kmorris_splunk
Splunk Employee
Splunk Employee

Try using multisearch. This isn't super fast, but it did the trick. I added an extra value to each list to play around with when there were multiple differences.

| multisearch 
    [ search source="result1.csv" NOT 
        [ search index="scratchpad" sourcetype="results" source="result2.csv" 
        | fields AVC_ID] 
    | eval OneNotTwo=AVC_ID 
    | fields OneNotTwo] 
    [ search source="result2.csv" NOT 
        [ search index="scratchpad" sourcetype="results" source="result1.csv" 
        | fields AVC_ID] 
    | eval TwoNotOne=AVC_ID 
    | fields TwoNotOne] 
| stats values(OneNotTwo) as OneNotTwo values(TwoNotOne) as TwoNotOne

alt text

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...