Splunk Search

Comparing 2 searches using different sources?

ckutach
Engager

I am trying to make 2 searches using different indexes and sources

The first search is looking for all entries with "message sent" and the "Message Id". The second search is looking for the "Message Id" and "message sent".

 I am trying to find the number of messages that were sent but not received by comparing the message ID, and list the message IDs that were not sent

Example Attempt:

(index = exampleindex1 source = examplesource1 ("message sent" AND "MessageId")  
OR (index = exampleindex2 source = examplesource2 ("message received" AND "MessageId") 
| rex field=_raw "MessageId:(?<messageId>[\S]+)\s.*" 
| stats values(*) as * by messageId

 

Labels (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Something like

(index = exampleindex1 source = examplesource1 ("message sent" AND "MessageId") )
OR (index = exampleindex2 source = examplesource2 ("message received" AND "MessageId") )
| rex field=_raw "MessageId:(?<messageId>[\S]+)\s.*"
| rex "\bmessage\s+<?type>(sent|received)\b" ``` no need to specify field if _raw ```
| stats dc(messageId) as msgCount by type
| eval msgCount = if(type == "received", -msgCount, msgCount)
| stats sum(msgCount) as sent_not_received

You missed a couple parenthesis.

Tags (2)
0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...