Splunk Search

Display only values found in two searches

New Member

index=rap sourcetype="joyner lucas"
| dedup albums| table albums
|append [search index=country sourcetype="lil Nas"
|dedup songs| table songs]

Tags (1)
1 Solution
SplunkTrust

try this:

``````(index=rap sourcetype="joyner lucas" albums=*) OR (index=country sourcetype="lil Nas" songs=*)
| eval check_match = coalesce(albums,songs)
| stats count by check_match
| where count > 1
``````

here is an example to try anywhere:

``````| makeresults count=1
| eval data = "x,y,z,123;;;x,y,z,124;;;x,y,z,125;;;x,y,z,126;;;a,b,c,123;;;a,b,c,134;;;a,b,c,125;;;a,b,c,136"
| makemv delim=";;;" data
| mvexpand data
| rex field=data "(?<idx>[^\,]+)\,(?<st>[^\,]+)\,(?<letter>[^\,]+)\,(?<number>.+)"
| eval album = if(idx=="x",number,null())
| eval song = if(idx="a",number,null())
| table idx st album song
| rename COMMENT as "the above generates data below is the solution"
| search (idx=x st=y album=*) OR (idx=a st=b song=*)
| eval check_match = coalesce(album,song)
| stats count by check_match
| where count > 1
``````

hope it helps

New Member

From this answer, how would I chart the matches of this search?

`````` (index=rap sourcetype="joyner lucas" albums=*) OR (index=country sourcetype="lil Nas" songs=*)
| eval check_match = coalesce(albums,songs)
| stats count by check_match
| where count > 1
``````
SplunkTrust

try this:

``````(index=rap sourcetype="joyner lucas" albums=*) OR (index=country sourcetype="lil Nas" songs=*)
| eval check_match = coalesce(albums,songs)
| stats count by check_match
| where count > 1
``````

here is an example to try anywhere:

``````| makeresults count=1
| eval data = "x,y,z,123;;;x,y,z,124;;;x,y,z,125;;;x,y,z,126;;;a,b,c,123;;;a,b,c,134;;;a,b,c,125;;;a,b,c,136"
| makemv delim=";;;" data
| mvexpand data
| rex field=data "(?<idx>[^\,]+)\,(?<st>[^\,]+)\,(?<letter>[^\,]+)\,(?<number>.+)"
| eval album = if(idx=="x",number,null())
| eval song = if(idx="a",number,null())
| table idx st album song
| rename COMMENT as "the above generates data below is the solution"
| search (idx=x st=y album=*) OR (idx=a st=b song=*)
| eval check_match = coalesce(album,song)
| stats count by check_match
| where count > 1
``````

hope it helps

New Member

I would like to list the values that match

.conf21 Now Fully Virtual!