Splunk Search
Highlighted

How do you find details about results using the set command with a diff argument?

New Member

I am using two searches

Search1 search 2
1 1
2 2
3 3
5 4

Using set diff gives me the result. I don't want to use join.

set diff [search index=ABC sourcetype=PQRS| stats count by x_orderno | fields - count]
[search index=DEF sourcetype=WXYZ| stats count by x_orderno | fields - count]

x_orderno
5
4

I want the result as
x_orderno sourcetype
5 PQRS
4 WXYZ

Kindly suggest.

TIA

0 Karma
Highlighted

Re: How do you find details about results using the set command with a diff argument?

SplunkTrust
SplunkTrust

Try like this

(index=ABC sourcetype=PQRS) OR (index=DEF sourcetype=WXYZ)
| stats values(sourcetype) as sourcetype by x_orderno
| where mvcount(sourcetype)=1
0 Karma
Highlighted

Re: How do you find details about results using the set command with a diff argument?

Esteemed Legend

Like this:

| makeresults 
| eval raw="sourcetype=PQRS,x_orderno=1 sourcetype=WXYZ,x_orderno=1 sourcetype=PQRS,x_orderno=2 sourcetype=WXYZ,x_orderno=2 sourcetype=PQRS,x_orderno=3 sourcetype=WXYZ,x_orderno=3 sourcetype=PQRS,x_orderno=5 sourcetype=WXYZ,x_orderno=4" 
| makemv raw 
| mvexpand raw 
| rename raw AS _raw 
| kv

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| stats dc(sourcetype) AS sourcetypeCount values(sourcetype) AS sourcetype BY x_orderno
| where sourcetypeCount==1
| table x_orderno sourcetype

View solution in original post

0 Karma
Highlighted

Re: How do you find details about results using the set command with a diff argument?

New Member

Awesome. Thanks 🙂

0 Karma