Splunk Search

Compare data between 2 indexes

surekhasplunk
Communicator

Hi i am using below query to get the results for Ip

index=shinken sourcetype=shinken_alarms Level=HARD Status!=UP Status!=OK Status!=UNKNOWN NOT [|inputlookup Shinken_Flapping_Devices.csv | rename Hostname as Device | fields Device] | lookup   KV_UNICORN.csv  Device output  "Infrastructure Name" Environment Type Ip| fillnull "Infrastructure Name"  | search "Infrastructure Name"!=0 | search Environment="Production"  OR Environment="Production - Backup"  | stats count by Ip

Then i have another query which give me results by IP

index="spectrum"  * | spath "alarm.@id" |spath "alarm.attribute{}.$" | spath "alarm.attribute{}.@id" | search "alarm.attribute{}.$"=psehlx20| eval foo=_cd | rename "alarm.attribute{}.$" as value "alarm.attribute{}.@id" as attr | table _time foo attr value| eval id=_cd | eval value=mvzip(attr,value) | mvexpand value | eval attr=mvindex(split(value,","),0) | eval value=mvindex(split(value,","),1) | lookup attr_alarm_spectrum.csv attr OUTPUT field | table _time,field,value,foo | fillnull field,value,foo  | eval {field}=value | fields - field,value | stats values(*) as * by _time,foo | fields - foo  | eval Severity=if(Severity="3","Critical",if(Severity="2","Major","Minor")) | search Severity=* (Name="***" OR IP="*")  | lookup  State_of_the_Asset_List_on_Unicorn.csv Ip as IP output  "Infrastrucure Name" | lookup spectrum_database_v2.csv Network_Address as IP  output Topology_Model_Name_String
| table _time, Severity,Name,IP,Secure_Domain,Type,Title,Landscape,Acknowledged,Ticket_ID "Topology_Model_Name_String" "Infrastrucure Name"  
| sort -_time | stats count by IP 

Now i have to show in the dashboard to show ips common to both indexes and the respective counts. So that we can see the difference of count for one ip in both the indexes.

Tags (2)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...