Splunk Search

Splunk search for field values in multiple sources

infotork
Explorer

There are two sourcetypes ,

sourcetype=A  sourcetype=B  and we have extracted a field "login" in both sourcetypes

1. we need to have a "count"  of the login values which are available in sourcetype=A but not in sourcetype=B

2. we need to have a "list of values"  of the login values which are available in sourcetype=A but not in sourcetype=B

3. Any Graph that we can show the these many "login" are missing in compare with sourcetypes using timechart? - any suggestions?

Labels (3)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
sourcetype="A" OR sourcetype="B"
| eval sourcetypeA=if(sourcetype="A",sourcetype,null)
| eval sourcetypeB=if(sourcetype="B",sourcetype,null)
| stats values(sourcetypeA) as sourcetypeA values(sourcetypeB) as sourcetypeB by login
| where sourcetypeA="A" and isnull(sourcetypeB)
| stats count
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...