Splunk Search

Compare Two IDs in Different Events

dsitek
Explorer

I am creating a search that finds ID's in two different logs, one when the ID is created and another when the ID is submitted. I only want to find IDs that were created and then adandoned, so I wrote the following search to extract IDs and only extract un-submitted ones.
| multisearch
[ search index=ff ...
| rex field=_raw "^[^{]*(?P<my_data>.+)"
| spath input=my_data output=cart_id path=cartId
| eval type="search1"]
[ search index=ff "slotSubmitOrderByCartId() - Input Parameters"
| rex field=_raw "Input\sparameters:\s(?<cart_id>.+)\s,\s{" ]
| table cart_id
| stats count by cart_id
| search count=1

The issue is that if a cart was submitted long enough past its created time, then it will only appear once in the logs and be included in the list of IDs with a single event. Is there a way to find only logs that appear in created calls? I would like to avoid using a lookup if possible.

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...