Splunk Search

How to compare columns in a row

ewanbrown
Path Finder

Hi

I have a query that produces some output like this:

ID server_a.1  server_a.2        server_b.1           server_b.2
1  0                   0            1                       0
2  1                   0            1                       1
3  1                   1            0                       0

I'd like to be able to add to it to tell me the number of ID's which are present in server_a*, but not in server_b* and visa versa. I think I can do it by making this an inner query, however I need to do it across millions of records, so that is not an option

Any help is appreciated!

Thanks

Tags (1)
0 Karma

woodcock
Esteemed Legend

Append this to your search:

... | foreach server_a* [eval A = A + <<FIELD>>] | foreach server_b* [eval B = B + <<FIELD>>] | multireport | [stats dc(ID) AS dcIDbyA values(ID) AS valuesIDbyA BY A] [stats dc(ID) as dcIDbyB values(ID) AS valuesIDbyB BY B]
0 Karma

somesoni2
Revered Legend

If the name of servers are fixed/static, then something like this could work

your current search giving above output | addtotals server_a* fieldname=present_in_server_a | addtotals server_b* fieldname=present_in_server_b | eval status=case(present_in_server_a =0 AND present_in_server_b>0 ,"Present in server_b* only", present_in_server_a >0 AND present_in_server_b=0,"Present in server_a* only",1=1,"Present in both")

This will add a field status to specify which ID is present in which servers. You can further chart the count if you need

above search | stats count by status

ewanbrown
Path Finder

Perfect, thanks

0 Karma

lguinn2
Legend

It would be helpful to see the search that produced this.
I have a feeling that this table was produced by a chart command - but by using a stats command then xyseries, I think you can easily get what you want.

0 Karma

ewanbrown
Path Finder

Hi,

I've the answer now, but the source query was:

index=beacons| spath | eval       temp=mvzip(mvzip(mvzip('bean.data.matches{}.clusterId','bean.data.matches{}.facility'),'bean.data.matches{}.matchStatus'), 'bean.data.matches{}.cluster') | mvexpand temp | eval x = split(temp,",") | eval clusterId=mvindex(x,0) | eval facility=mvindex(x,1) | eval match_status=mvindex(x,2) | eval cluster=mvindex(x,3) | search cluster=1 OR cluster=2 OR cluster=3 |  chart count by clusterId, facility
0 Karma
Get Updates on the Splunk Community!

Fall Into Learning with New Splunk Education Courses

Every month, Splunk Education releases new courses to help you branch out, strengthen your data science roots, ...

Super Optimize your Splunk Stats Searches: Unlocking the Power of tstats, TERM, and ...

By Martin Hettervik, Senior Consultant and Team Leader at Accelerate at Iver, Splunk MVPThe stats command is ...

How Splunk Observability Cloud Prevented a Major Payment Crisis in Minutes

Your bank's payment processing system is humming along during a busy afternoon, handling millions in hourly ...