Splunk Search

How to compare values in fields from 2 indexes?

Luninho
Explorer

I have 2 indexes: index1 and index2. I need to compare values in both indexes and show only differences in fields. In both indexes always exist the same field - time, so I need match by this field.

For example:

Index1
Time - 26.11.20
Field1 - xxxx
Field2 - xxxx

and

Index2
Time - 26.11.20
Field1 - xxxx
Field2 - xxxy

I want to get a table:

Field2 - xxxx
Field2 - xxxy

Labels (1)
Tags (1)
0 Karma

to4kawa
Ultra Champion
| makeresults
| eval Time="26.11.20",Field1="xxxx",Field2="xxxx"
| appendpipe [eval Time="26.11.20",Field1="xxxx",Field2="xxxy"]
| rename COMMENT as "From here, the logic"
| untable Time Field Value
| stats values(Value) as Value by Time Field
| where mvcount(Value)=2
| xyseries Time Field Value
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...