Splunk Search

Compare a search with two sources

anmar02930
Engager

I have a search that has "index=A", "Source=A", "Source=B" and both sources have the column "Address"

I want to compare what is in source A but not in Source B based on the Values "Address" 

Labels (3)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

You need to define "compare".  If all that interest you is which addresses are different, it could be as simple as

index=A source IN (A,B) ``` both have common field address ```
| stats values(source) as source by address ``` source is now multivalued ```
| where source == "A" AND source != "B" ``` SPL allows multivalued equality test ```

Hope this helps.

View solution in original post

yuanliu
SplunkTrust
SplunkTrust

You need to define "compare".  If all that interest you is which addresses are different, it could be as simple as

index=A source IN (A,B) ``` both have common field address ```
| stats values(source) as source by address ``` source is now multivalued ```
| where source == "A" AND source != "B" ``` SPL allows multivalued equality test ```

Hope this helps.

Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...