Splunk Search

Compare a search with two sources

anmar02930
Engager

I have a search that has "index=A", "Source=A", "Source=B" and both sources have the column "Address"

I want to compare what is in source A but not in Source B based on the Values "Address" 

Labels (3)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

You need to define "compare".  If all that interest you is which addresses are different, it could be as simple as

index=A source IN (A,B) ``` both have common field address ```
| stats values(source) as source by address ``` source is now multivalued ```
| where source == "A" AND source != "B" ``` SPL allows multivalued equality test ```

Hope this helps.

View solution in original post

yuanliu
SplunkTrust
SplunkTrust

You need to define "compare".  If all that interest you is which addresses are different, it could be as simple as

index=A source IN (A,B) ``` both have common field address ```
| stats values(source) as source by address ``` source is now multivalued ```
| where source == "A" AND source != "B" ``` SPL allows multivalued equality test ```

Hope this helps.

Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...