Splunk Search

Display only values found in two searches

atl215
New Member

index=rap sourcetype="joyner lucas"
| dedup albums| table albums
|append [search index=country sourcetype="lil Nas"
|dedup songs| table songs]

Tags (1)
0 Karma
1 Solution

adonio
SplunkTrust
SplunkTrust

try this:

(index=rap sourcetype="joyner lucas" albums=*) OR (index=country sourcetype="lil Nas" songs=*)
| eval check_match = coalesce(albums,songs)
| stats count by check_match 
| where count > 1

here is an example to try anywhere:

| makeresults count=1
| eval data = "x,y,z,123;;;x,y,z,124;;;x,y,z,125;;;x,y,z,126;;;a,b,c,123;;;a,b,c,134;;;a,b,c,125;;;a,b,c,136"
| makemv delim=";;;" data 
| mvexpand data
| rex field=data "(?<idx>[^\,]+)\,(?<st>[^\,]+)\,(?<letter>[^\,]+)\,(?<number>.+)"
| eval album = if(idx=="x",number,null())
| eval song = if(idx="a",number,null())
| table idx st album song
| rename COMMENT as "the above generates data below is the solution" 
| search (idx=x st=y album=*) OR (idx=a st=b song=*)
| eval check_match = coalesce(album,song)
| stats count by check_match
| where count > 1

hope it helps

View solution in original post

0 Karma

atl215
New Member

From this answer, how would I chart the matches of this search?

 (index=rap sourcetype="joyner lucas" albums=*) OR (index=country sourcetype="lil Nas" songs=*)
 | eval check_match = coalesce(albums,songs)
 | stats count by check_match 
 | where count > 1
0 Karma

adonio
SplunkTrust
SplunkTrust

try this:

(index=rap sourcetype="joyner lucas" albums=*) OR (index=country sourcetype="lil Nas" songs=*)
| eval check_match = coalesce(albums,songs)
| stats count by check_match 
| where count > 1

here is an example to try anywhere:

| makeresults count=1
| eval data = "x,y,z,123;;;x,y,z,124;;;x,y,z,125;;;x,y,z,126;;;a,b,c,123;;;a,b,c,134;;;a,b,c,125;;;a,b,c,136"
| makemv delim=";;;" data 
| mvexpand data
| rex field=data "(?<idx>[^\,]+)\,(?<st>[^\,]+)\,(?<letter>[^\,]+)\,(?<number>.+)"
| eval album = if(idx=="x",number,null())
| eval song = if(idx="a",number,null())
| table idx st album song
| rename COMMENT as "the above generates data below is the solution" 
| search (idx=x st=y album=*) OR (idx=a st=b song=*)
| eval check_match = coalesce(album,song)
| stats count by check_match
| where count > 1

hope it helps

View solution in original post

0 Karma

atl215
New Member

I would like to list the values that match

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!