Splunk Search

Compare a search with two sources

anmar02930
Engager

I have a search that has "index=A", "Source=A", "Source=B" and both sources have the column "Address"

I want to compare what is in source A but not in Source B based on the Values "Address" 

Labels (3)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

You need to define "compare".  If all that interest you is which addresses are different, it could be as simple as

index=A source IN (A,B) ``` both have common field address ```
| stats values(source) as source by address ``` source is now multivalued ```
| where source == "A" AND source != "B" ``` SPL allows multivalued equality test ```

Hope this helps.

View solution in original post

yuanliu
SplunkTrust
SplunkTrust

You need to define "compare".  If all that interest you is which addresses are different, it could be as simple as

index=A source IN (A,B) ``` both have common field address ```
| stats values(source) as source by address ``` source is now multivalued ```
| where source == "A" AND source != "B" ``` SPL allows multivalued equality test ```

Hope this helps.

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...