Splunk Search

Splunk search for field values in multiple sources

infotork
Explorer

There are two sourcetypes ,

sourcetype=A  sourcetype=B  and we have extracted a field "login" in both sourcetypes

1. we need to have a "count"  of the login values which are available in sourcetype=A but not in sourcetype=B

2. we need to have a "list of values"  of the login values which are available in sourcetype=A but not in sourcetype=B

3. Any Graph that we can show the these many "login" are missing in compare with sourcetypes using timechart? - any suggestions?

Labels (3)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
sourcetype="A" OR sourcetype="B"
| eval sourcetypeA=if(sourcetype="A",sourcetype,null)
| eval sourcetypeB=if(sourcetype="B",sourcetype,null)
| stats values(sourcetypeA) as sourcetypeA values(sourcetypeB) as sourcetypeB by login
| where sourcetypeA="A" and isnull(sourcetypeB)
| stats count
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...