Splunk Search

How to evaluate data match from 2 sources

tkwaller1
Path Finder

I have a search that searches 2 different indexes. We expect that there is 1 record from each index for a single id. The search is pretty simple:

 

index=index1 
| rename Number__c as EventId
| append [search index=index2 sourcetype="api" ]
| stats count by EventId
| search count < 2

 

What i would like to do now is evaluate that there is a single record from each index for each EventId, to ensure that the count of 2 isn't 2 records in a single index. There are times where, in index2, a single EventId has more than one record which makes the count inaccurate because it's not evaluating whether there was a record for it in index1.

 

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try counting the number of indexes for each EventId.

index=index1 
| rename Number__c as EventId
| append [search index=index2 sourcetype="api" ]
| stats count, dc(index) as indexCount by EventId
| search count < 2 OR indexCount=1

Also, the append command is inefficient and not necessary in this case.  Try this

index=index1 OR (index=index2 sourcetype="api")
| rename Number__c as EventId
| stats count, dc(index) as indexCount by EventId
| search count < 2 OR indexCount=1

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

tkwaller_2
Communicator

This worked well.
Last question:
If i wanted to ensure the single record that i find only comes from search 1 and not from search 2. how would i do that.

Thanks again

Todd

0 Karma

tkwaller_2
Communicator

This worked well.
Last question:
If i wanted to ensure the single record that i find only comes from search 1 and not from search 2. how would i do that.


Thanks again

Todd

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try counting the number of indexes for each EventId.

index=index1 
| rename Number__c as EventId
| append [search index=index2 sourcetype="api" ]
| stats count, dc(index) as indexCount by EventId
| search count < 2 OR indexCount=1

Also, the append command is inefficient and not necessary in this case.  Try this

index=index1 OR (index=index2 sourcetype="api")
| rename Number__c as EventId
| stats count, dc(index) as indexCount by EventId
| search count < 2 OR indexCount=1

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...