Splunk Search

How to compare output of two splunk queries where nothing is common

Emily12
Explorer

 

Hi Everyone

I have 2 queries 

1) mysearchquery | table xyz

 

2) mysearchquery| table abc

And these two queries does not have anything common

I need to compare xyz and abc in a single query 

How can I do that.

Thank you in advance 

Labels (1)
0 Karma

Emily12
Explorer

@ITWhisperer  basically I want to know how to join the search query result of 2 queries

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
mysearchquery | table xyz
| join type=left [ mysearchquery | table abc ]

Note that subsearches are limited by the number of events so if you can combine your two searches into one to do your calculations for xyz and abc it might be better

0 Karma

Emily12
Explorer

Hi @ITWhisperer 

Xyz and abc will return some integer value to me so I will compare like if xyz=abc

0 Karma

danspav
SplunkTrust
SplunkTrust

If you are trying to add two numbers from two different searches it's highly likely you can do that in one search using stats.

Are you able to share more about each search?

Otherwise, you can do an append to combine the two outputs with something like:

| makeresults | eval abc=100 | table abc
| append [| makeresults |eval xyz=45 | table xyz]
| stats sum(abc) as abc, sum(xyz) as xyz
| eval total = abc + zyz

This search gets your first number, abc, then appends the second number, xyz.
Then we run stats to get them on one row, and finally do a simple eval for the total.

You could then use this result in a single value visualization on a dashboard.

But as I mentioned, you can probably get both totals using stats. See docs for more info.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Hi @Emily12 

If the two tables have nothing in common, what criteria are you going to use to compare them? 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...