Splunk Search

Compare logs between different host and match the value.

DougiieDee
Explorer
I have two different hosts . hostA-1, hostA-2, hostA-3, hostA-4, hostA-5 . hostB-5, hostB-6, hostB-7, hostB-8. I want to compare the specific value from the logs that are matched like Token which are unique but wanted to find if the value are matched between hostA and hostB and form a table based on that which will show hosts name A and B and below will be the matching token
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You said two hosts but then gave 8 values, are you just interested in the first part of the name?

Can you share some sample events and show which fields are already extracted and which is these would be considered as Tokens?

0 Karma

DougiieDee
Explorer
My bad i should have explained in detail. hostA and hostB are like datacenters and 1,2,3.... are hosts. and wanted to check side by side to those datacenters and only get the token value that matches. here is the sample log: 2021-08-05 19:01:59.677 INFO RestTemplate: {"logType":"STANDARD","message":"==========================request log================================================", "Method":"POST","Headers":"{Accept=[application/json], Content-Type=[application/json], Authorization=[Bearer eyJhQM8DMG8bEtCIsiZ0GjyYWxwt3ny1Q], Token=[basd23123], "Request body": {"accountNumber":824534875389475}}} hostA = 1 source = a.log sourcetype = a_log 2021-08-05 19:01:59.687 INFO RestTemplate: {"logType":"STANDARD","message":"==========================request log================================================", "Method":"POST","Headers":"{Accept=[application/json], Content-Type=[application/json], Authorization=[Bearer eyJhQM8DMG8bEtCIsiZ0GjyYWxwt3ny1Q], Token=[basd23123], "Request body": {"accountNumber":824534875389475}}} hostb = 6 source = a.log sourcetype = a_log if the Token matches on both hostA and hostB then only the matched are needed.
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "Token=\[(?<token>[^\]]+)\].+(?<host>host\w+)\s"
| eventstats values(host) as hosts by token
| where mvcount(hosts) = 2
0 Karma

DougiieDee
Explorer
it didnt show any events
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...