Splunk Search

How to calculate the difference between count of two different searches?


Hi all.

I have a first search:

index=first sourcetype=type1 | stats count 

And a second:

index=first  sourcetype=data_sourcetype | join ID  [search index="second" sourcetype="datatype2"] | stats count 

Both cases returns number of events. But I need to calculate the number difference between the first search's value and the second. How i can proceed?


0 Karma

Revered Legend

Try this

index=first  (sourcetype=data_sourcetype  [search index="second" sourcetype="datatype2" | stats count by ID | table ID ] ) OR sourcetype=type1 
| chart count over index by sourcetype | eval difference='data_sourcetype' - 'type1'
0 Karma


Based on the above search you might not need join for the second search. See if following query helps:

(index="first" sourcetype="data_sourcetype" ) OR (index="second" sourcetype="datatype2") | stats count as count1 | appendcols [search index="first" sourcetype="type1"| stats count as count2]| eval difference=count1-count2| table count1, count2, difference

You can also save index AND sourcetype searches as three different eventtypes and then use stats count by eventtype as your query. accum and delta can be used on different rows of search results by eventtype.

| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...