Splunk Search

How to compare output of two splunk queries where nothing is common

Emily12
Explorer

 

Hi Everyone

I have 2 queries 

1) mysearchquery | table xyz

 

2) mysearchquery| table abc

And these two queries does not have anything common

I need to compare xyz and abc in a single query 

How can I do that.

Thank you in advance 

Labels (1)
0 Karma

Emily12
Explorer

@ITWhisperer  basically I want to know how to join the search query result of 2 queries

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
mysearchquery | table xyz
| join type=left [ mysearchquery | table abc ]

Note that subsearches are limited by the number of events so if you can combine your two searches into one to do your calculations for xyz and abc it might be better

0 Karma

Emily12
Explorer

Hi @ITWhisperer 

Xyz and abc will return some integer value to me so I will compare like if xyz=abc

0 Karma

danspav
SplunkTrust
SplunkTrust

If you are trying to add two numbers from two different searches it's highly likely you can do that in one search using stats.

Are you able to share more about each search?

Otherwise, you can do an append to combine the two outputs with something like:

| makeresults | eval abc=100 | table abc
| append [| makeresults |eval xyz=45 | table xyz]
| stats sum(abc) as abc, sum(xyz) as xyz
| eval total = abc + zyz

This search gets your first number, abc, then appends the second number, xyz.
Then we run stats to get them on one row, and finally do a simple eval for the total.

You could then use this result in a single value visualization on a dashboard.

But as I mentioned, you can probably get both totals using stats. See docs for more info.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Hi @Emily12 

If the two tables have nothing in common, what criteria are you going to use to compare them? 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...