Splunk Search

Comparing differences in the same field depending on the row grouping field

jo54
Explorer

I'll try to explain it with a basic example. As an output of a stats command I have:

detectionquery
search1
google.com
yahoo.com
search2
google.com
bing.com

 

I want to get which queries are not being detected by both search1 and search 2. Or else, getting rid of the queries that are in both searches, either way work. Like ok, search1 is detecting yahoo.com whereas search2 isn't, and viceversa with bing.com

I thought about grouping by query instead of by search,  the problem is I have dozens or even hundreds of queries.

Any thoughts? Cheers

Labels (2)
0 Karma
1 Solution

marnall
Motivator

You could stats count by query. Queries that are found by both detections will have count=2, while queries that are found by only one will have count=1. Then you can filter for count=1 to remove the hundreds of queries that are found by both detections.

| stats count by query
| where count = 1

 

View solution in original post

0 Karma

marnall
Motivator

You could stats count by query. Queries that are found by both detections will have count=2, while queries that are found by only one will have count=1. Then you can filter for count=1 to remove the hundreds of queries that are found by both detections.

| stats count by query
| where count = 1

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| stats count by query
0 Karma
Get Updates on the Splunk Community!

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...

Splunk With AppDynamics - Meet the New IT (And Engineering) Couple

Wednesday, November 20, 2024  |  10AM PT / 1PM ET Register Now Join us in this session to learn all about ...