Hi i am using below query to get the results for Ip
index=shinken sourcetype=shinken_alarms Level=HARD Status!=UP Status!=OK Status!=UNKNOWN NOT [|inputlookup Shinken_Flapping_Devices.csv | rename Hostname as Device | fields Device] | lookup KV_UNICORN.csv Device output "Infrastructure Name" Environment Type Ip| fillnull "Infrastructure Name" | search "Infrastructure Name"!=0 | search Environment="Production" OR Environment="Production - Backup" | stats count by Ip
Then i have another query which give me results by IP
index="spectrum" * | spath "alarm.@id" |spath "alarm.attribute{}.$" | spath "alarm.attribute{}.@id" | search "alarm.attribute{}.$"=psehlx20| eval foo=_cd | rename "alarm.attribute{}.$" as value "alarm.attribute{}.@id" as attr | table _time foo attr value| eval id=_cd | eval value=mvzip(attr,value) | mvexpand value | eval attr=mvindex(split(value,","),0) | eval value=mvindex(split(value,","),1) | lookup attr_alarm_spectrum.csv attr OUTPUT field | table _time,field,value,foo | fillnull field,value,foo | eval {field}=value | fields - field,value | stats values(*) as * by _time,foo | fields - foo | eval Severity=if(Severity="3","Critical",if(Severity="2","Major","Minor")) | search Severity=* (Name="***" OR IP="*") | lookup State_of_the_Asset_List_on_Unicorn.csv Ip as IP output "Infrastrucure Name" | lookup spectrum_database_v2.csv Network_Address as IP output Topology_Model_Name_String
| table _time, Severity,Name,IP,Secure_Domain,Type,Title,Landscape,Acknowledged,Ticket_ID "Topology_Model_Name_String" "Infrastrucure Name"
| sort -_time | stats count by IP
Now i have to show in the dashboard to show ips common to both indexes and the respective counts. So that we can see the difference of count for one ip in both the indexes.
