Splunk Search

How to find missing ip's from search1 in search2 and find the stats percentage missing ip's?

kpavan
Path Finder

Hi,

am trying to find list of ip's from search1 which are missing in search2 and get all the ip from search1 and calculate the percentage of missing ip's. This will help to identify the number of ip's.

 

Thanks in advance!

Labels (1)
0 Karma

kpavan
Path Finder

Thanks for both response!

 

Meanwhile i was working different method like below, I got percentage results, wanted to confirm if this is correct way of doing it? or anything wrong in it.

(
(index=compliance sourcetype=site1-ip ) OR
(index=automation sourcetype=site2-asset))
| eval ip=case(sourcetype="site1-ip", 'src.ip', sourcetype="site2-asset", ip )
| eval te=if(sourcetype="site2-asset","yes","no")
| eval ta=if(sourcetype="site1-ip","yes","no")
| stats max(eval(if(te="yes",1,0))) AS SCANNED max(eval(if(ta="yes",1,0))) AS CTA values(fqdn) as fqdn_ta values(resourceOwner) as ip.owner by ip
| search (CTA=1)
| stats count(eval( SCANNED > 0)) AS tes, count(ip) as total
| eval percent = round((tes/(total))*100,2)

Thanks again!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming ip occurs at most once in both searches

search1
| eval search=1
| append [search2 | eval search=-1]
| stats sum(search) as search by ip
| stats count(eval(search==1)) as ip1 count
| eval percent=100*ip1/count
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @kpavan,

you should explore the dc option in stats, something like this:

(index=index1) OR (index=index2)
| eval ip=if(index=index1,ip_1,ip_2)
| stats dc(index) AS dc_index values(index) AS index BY ip
| eval status=case(dc_index=2,"both indexes",dc_index=1 AND index=index1,"only index1",dc_index=1 AND index=index2,"only index2")
| stats dc(ip) AS count BY status

In this way you can know if an Ip is present in both the indexes or only in one of them and you can make all the operations you want.

Ciao.

Giuseppe

 

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...