Splunk Search

How to calculate the difference between two fields from different sources?

jfeitosa_real
Path Finder

Hi All, please.

How to get the difference between two fields from different sources? For example, know what is contained in one that is not contained in another. It reads AV (Antivirus).

Example:
source = AV_X
HostName = Server01
HostName = Server02
HostName = Server03
HostName = Server04
HostName = Server05

source = AV_Y
CompName = Server01A
CompName = Server02
CompName = Server03
CompName = Server04
CompName = Server08A

source = AV_Z
cName = Server01A
cName = Server02
cName = Server03B
cName = Server04B
cName = Server05

Thank you in advance.

Tags (1)
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@jfeitosa_real,

From your sample data ,if HostName , CompName and cName are referring to the same fields, we could rename that to a single field name and do a stats on the data to find the difference. ( Instead of renaming, we can create new eval field as well)

For e.g.

(source=AV_X OR source=AV_Y OR source=AV_Z) |rename CompName  as HostName ,cName  as HostName
|stats values(source) as v_source,dc(source) as c_source by HostName

From the above search, you will get

  • c_source = 1 - The host is only contains in source v_source
  • c_source=2 - The host contains in two sources listed under v_source
  • c_source=3 -The host contains in all sources

Based on your requirement, you can use the data from this result and fine tune.

Lets know if it works

Happy Splunking!

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@jfeitosa_real,

From your sample data ,if HostName , CompName and cName are referring to the same fields, we could rename that to a single field name and do a stats on the data to find the difference. ( Instead of renaming, we can create new eval field as well)

For e.g.

(source=AV_X OR source=AV_Y OR source=AV_Z) |rename CompName  as HostName ,cName  as HostName
|stats values(source) as v_source,dc(source) as c_source by HostName

From the above search, you will get

  • c_source = 1 - The host is only contains in source v_source
  • c_source=2 - The host contains in two sources listed under v_source
  • c_source=3 -The host contains in all sources

Based on your requirement, you can use the data from this result and fine tune.

Lets know if it works

Happy Splunking!
0 Karma

jfeitosa_real
Path Finder

Thanks renjith.nair, was exactly what he wanted.

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...