Splunk Search

How do i compare two different fields , with the same name, from two different sourcetypes?

splunkclarium
New Member

How do i compare two different fields , with the same name, from two different sourcetypes?
I am trying to check one data source against another, but I seem to only get results from a single source
I tried two approaches and neither works. I believe because it is because the field has the same name.
The field is dest:

First attempt:
(index=A sourcetype="A") OR (index=B sourcetype="B")
| dedup dest, sourcetype
| stats dc(sourcetype) as sourcetypes by dest

Second attempt:
(index=A sourcetype="B") OR (index=A)
| stats dc(index) as occurrence by dest
| where occurrence < 2

Tags (1)
0 Karma

HiroshiSatoh
Champion

I think that you can compare in the first attempt.

Try this!

(index=A sourcetype="A") OR (index=B sourcetype="B") 
| stats dc(sourcetype) as occurrence,value(sourcetype) as sourcetypes by dest
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...