Splunk Search

Get different element between 2 sources with join or other command?

Buscatrufas
Path Finder

Hi guys,

I have 2 sources, historical and current, i need to catch the new events in my monitor, so i compare current with historical, i cant match the persistents events but no the new

Any help with join o command that can do this?

Thanks, Buscatrufas.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Assuming there is some kind of identifier, you could do this:

index=foo (source=historical OR source=new) | stats values(source) as sources by identifier | search NOT sources=historical

That would give you a list of identifiers that are present in the new source, but weren't present in the historical source.
This search is fairly generic, if you want more specific help you'll have to provide more specific details about your events.

0 Karma

sundareshr
Legend

Try something this. This should return everything from new, that does not have a corresponding "matchingfield" in historical

index=new NOT [ search index=historical | table matchingfield]

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...