Splunk Search

How to evaluate data match from 2 sources

tkwaller1
Path Finder

I have a search that searches 2 different indexes. We expect that there is 1 record from each index for a single id. The search is pretty simple:

 

index=index1 
| rename Number__c as EventId
| append [search index=index2 sourcetype="api" ]
| stats count by EventId
| search count < 2

 

What i would like to do now is evaluate that there is a single record from each index for each EventId, to ensure that the count of 2 isn't 2 records in a single index. There are times where, in index2, a single EventId has more than one record which makes the count inaccurate because it's not evaluating whether there was a record for it in index1.

 

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try counting the number of indexes for each EventId.

index=index1 
| rename Number__c as EventId
| append [search index=index2 sourcetype="api" ]
| stats count, dc(index) as indexCount by EventId
| search count < 2 OR indexCount=1

Also, the append command is inefficient and not necessary in this case.  Try this

index=index1 OR (index=index2 sourcetype="api")
| rename Number__c as EventId
| stats count, dc(index) as indexCount by EventId
| search count < 2 OR indexCount=1

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

tkwaller_2
Communicator

This worked well.
Last question:
If i wanted to ensure the single record that i find only comes from search 1 and not from search 2. how would i do that.

Thanks again

Todd

0 Karma

tkwaller_2
Communicator

This worked well.
Last question:
If i wanted to ensure the single record that i find only comes from search 1 and not from search 2. how would i do that.


Thanks again

Todd

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try counting the number of indexes for each EventId.

index=index1 
| rename Number__c as EventId
| append [search index=index2 sourcetype="api" ]
| stats count, dc(index) as indexCount by EventId
| search count < 2 OR indexCount=1

Also, the append command is inefficient and not necessary in this case.  Try this

index=index1 OR (index=index2 sourcetype="api")
| rename Number__c as EventId
| stats count, dc(index) as indexCount by EventId
| search count < 2 OR indexCount=1

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...