Splunk Search

Compare IP_address field in 2 indexes and ignore the data with the same values / or matches and display the rest.

learningnow
New Member

Want to run a report by comparing 2 indexes on " IP_Addresses" field.

Ignore any matching " IP addresses" (If IP are present in both indexes then ignore else display in query / report)
or
list any unique " IP addresses" in either index (If present in one but not in one of the other index)

in last 7 days.

Thanks in advance.

0 Karma
1 Solution

renjith_nair
Legend

@learningnow ,

Try

(index=1 OR index=2) | stats dc(index) as count by IP_Addresses|where count < 2
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

0 Karma

renjith_nair
Legend

@learningnow ,

Try

(index=1 OR index=2) | stats dc(index) as count by IP_Addresses|where count < 2
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...

Stay Connected: Your Guide to February Tech Talks, Office Hours, and Webinars!

&#x1f48c;Keep the new year’s momentum going with our February lineup of Community Office Hours, Tech Talks, ...