Splunk Search

Performing Set operation using splunk query

darkhorse91
Loves-to-Learn

Hi ,

I have two queries, that have a common field someField

one helps me find inconsistencies:

sourcetype="my_source" someLog inconsistencies 

 other helps me find consistencies

sourcetype="my_source" someLog consistencies 

 This gives me both consistencies and inconsistencies:

sourcetype="my_source" someLog 

 Note that

someLog

 is just a text used an identifier that's common for both the queries.

if the someField was logged as inconsistent it can be logged as consistent in the future.

 

How can I find those values of someField that are truly inconsistent in a given time frame, retrospectively?i.e. if currently values are inconsistent I want to be able to search (in the past or future relative to the current search) those values that are truly inconsistent - not part of the consistent results in that time frame

Labels (2)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

As you noted that "someLog" is just a text identifier to connect the two sets.  I deduce that "consistencies" and "inconsistencies" are also mere text identifiers, not associated with a specific field.

If this is correct, your problem can be clarified as: Find values of someField that only occurs in events that contains identifier term "inconsistencies" and that do not contain identifier term "consistencies".  This way, it is easy to translate into SPL:

sourcetype="my_source" someLog (consistencies OR inconsistencies)
| eval consistent_or_not = if(searchmatch("consistencies"), "consistent", "inconsistent")
| stats values(someField) as someField by consistent_or_not
| stats values(consistent_or_not) as consistent_or_not by someField
| where mvcount(consistent_or_not) < 2 AND consistent_or_not == "inconsistent"

Hope this helps.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...