Splunk Search

Comparing 2 searches using different sources?

ckutach
Engager

I am trying to make 2 searches using different indexes and sources

The first search is looking for all entries with "message sent" and the "Message Id". The second search is looking for the "Message Id" and "message sent".

 I am trying to find the number of messages that were sent but not received by comparing the message ID, and list the message IDs that were not sent

Example Attempt:

(index = exampleindex1 source = examplesource1 ("message sent" AND "MessageId")  
OR (index = exampleindex2 source = examplesource2 ("message received" AND "MessageId") 
| rex field=_raw "MessageId:(?<messageId>[\S]+)\s.*" 
| stats values(*) as * by messageId

 

Labels (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Something like

(index = exampleindex1 source = examplesource1 ("message sent" AND "MessageId") )
OR (index = exampleindex2 source = examplesource2 ("message received" AND "MessageId") )
| rex field=_raw "MessageId:(?<messageId>[\S]+)\s.*"
| rex "\bmessage\s+<?type>(sent|received)\b" ``` no need to specify field if _raw ```
| stats dc(messageId) as msgCount by type
| eval msgCount = if(type == "received", -msgCount, msgCount)
| stats sum(msgCount) as sent_not_received

You missed a couple parenthesis.

Tags (2)
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...