Splunk Search

Compare Two IDs in Different Events

dsitek
Explorer

I am creating a search that finds ID's in two different logs, one when the ID is created and another when the ID is submitted. I only want to find IDs that were created and then adandoned, so I wrote the following search to extract IDs and only extract un-submitted ones.
| multisearch
[ search index=ff ...
| rex field=_raw "^[^{]*(?P<my_data>.+)"
| spath input=my_data output=cart_id path=cartId
| eval type="search1"]
[ search index=ff "slotSubmitOrderByCartId() - Input Parameters"
| rex field=_raw "Input\sparameters:\s(?<cart_id>.+)\s,\s{" ]
| table cart_id
| stats count by cart_id
| search count=1

The issue is that if a cart was submitted long enough past its created time, then it will only appear once in the logs and be included in the list of IDs with a single event. Is there a way to find only logs that appear in created calls? I would like to avoid using a lookup if possible.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

 Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team for an ...