Compare logs between different host and match the value.

[DougiieDee]

I have two different hosts . hostA-1, hostA-2, hostA-3, hostA-4, hostA-5 . hostB-5, hostB-6, hostB-7, hostB-8. I want to compare the specific value from the logs that are matched like Token which are unique but wanted to find if the value are matched between hostA and hostB and form a table based on that which will show hosts name A and B and below will be the matching token

[ITWhisperer]

You said two hosts but then gave 8 values, are you just interested in the first part of the name?

Can you share some sample events and show which fields are already extracted and which is these would be considered as Tokens?

[DougiieDee]

My bad i should have explained in detail. hostA and hostB are like datacenters and 1,2,3.... are hosts. and wanted to check side by side to those datacenters and only get the token value that matches. here is the sample log: 2021-08-05 19:01:59.677 INFO RestTemplate: {"logType":"STANDARD","message":"==========================request log================================================", "Method":"POST","Headers":"{Accept=[application/json], Content-Type=[application/json], Authorization=[Bearer eyJhQM8DMG8bEtCIsiZ0GjyYWxwt3ny1Q], Token=[basd23123], "Request body": {"accountNumber":824534875389475}}} hostA = 1 source = a.log sourcetype = a_log 2021-08-05 19:01:59.687 INFO RestTemplate: {"logType":"STANDARD","message":"==========================request log================================================", "Method":"POST","Headers":"{Accept=[application/json], Content-Type=[application/json], Authorization=[Bearer eyJhQM8DMG8bEtCIsiZ0GjyYWxwt3ny1Q], Token=[basd23123], "Request body": {"accountNumber":824534875389475}}} hostb = 6 source = a.log sourcetype = a_log if the Token matches on both hostA and hostB then only the matched are needed.

[ITWhisperer]

| rex "Token=\[(?<token>[^\]]+)\].+(?<host>host\w+)\s"
| eventstats values(host) as hosts by token
| where mvcount(hosts) = 2

[DougiieDee]

it didnt show any events