Splunk Search

Splunk set diff

LordShacks
New Member

I am comparing the results of two search queries using "| set diff [search1][search2]". This works correctly in that I get all of the results that are either in search1 or search2 but not both.

I would like to be able to add additional fields to my searches without factoring them into the diff process. It seems like the diff command on it's own has this functionality if the "attribute=" keyword is used, which, if I understand correctly, limits the diff operation to the field specified.

However, it doesn't look like I can use the attribute keyword when diff is used in conjuction with set. Is there any way I can display additional fields without having diff operate on them?

Tags (2)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

I am not sure what you need is possible through with just "|set". Try this workaround to see if it gets you what you want.

index=index1 (sourcetype="souce1" gameStart="20140304-1500" ) OR (sourcetype="source2" gameStart="20140304-1600") [| set diff [search index="index1" sourcetype="souce1" gameStart="20140304-1500" | stats count by playerID | fields playerID] [search index="index1" sourcetype="source2" gameStart="20140304-1600" | stats count by playerId | fields playerID]]

LordShacks
New Member

So the first search is:

index="index1" sourcetype="souce1" gameStart="20140304-1500" | stats count by playerID | fields playerID

And the second is exactly the same, except with a different gameStart:

index="index1" sourcetype="source2" gameStart="20140304-1600" | stats count by playerId | fields playerID

Using these searches with "| set diff" I get the ID of all the players who played in the first game or the second game but not both.

However, in addition to the playerID, I want to display next to each ID the start time of the game that they played in.

0 Karma

gnovak
Builder

What is the search you are using?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...