Splunk Search

Compare Two IDs in Different Events

dsitek
Explorer

I am creating a search that finds ID's in two different logs, one when the ID is created and another when the ID is submitted. I only want to find IDs that were created and then adandoned, so I wrote the following search to extract IDs and only extract un-submitted ones.
| multisearch
[ search index=ff ...
| rex field=_raw "^[^{]*(?P<my_data>.+)"
| spath input=my_data output=cart_id path=cartId
| eval type="search1"]
[ search index=ff "slotSubmitOrderByCartId() - Input Parameters"
| rex field=_raw "Input\sparameters:\s(?<cart_id>.+)\s,\s{" ]
| table cart_id
| stats count by cart_id
| search count=1

The issue is that if a cart was submitted long enough past its created time, then it will only appear once in the logs and be included in the list of IDs with a single event. Is there a way to find only logs that appear in created calls? I would like to avoid using a lookup if possible.

0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

 Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team for an ...

Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know

To Community SOAR App Developers - we're reaching out with an important update regarding Python 3.9's ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...