Splunk Search

deduping ans eliminating the duplicate vales from 2 different sourcer

svemurilv
Path Finder

Hi,
we are using a session ID to comparing the Client side server side data with diffrent names (session_c session_S). both the data will be in different indexes. where am trying to eliminate the data where sessionID was populating in both in server and client , i just want to filter out the sessionID was populated either only in client side or server side date.

earliest=1h@h  ( index=client  sourcetype=clientside ) OR (index=server sourcetype=serverside) |dedup session_c, session_S |where session_c!=session_S  |stats values(session_c),values(session_S)
Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

I would try something like this (last eval will filterout all sessionID which were appearing in both indexes)

( index=client  sourcetype=clientside ) OR (index=server sourcetype=serverside) earliest=1h@h 
| eval sessionID=coalesce(session_c, session_S) 
| stats values(session_c) as session_c values(session_S) as session_s dc(index) as indexes by sessionID
| where indexes=1

View solution in original post

somesoni2
Revered Legend

I would try something like this (last eval will filterout all sessionID which were appearing in both indexes)

( index=client  sourcetype=clientside ) OR (index=server sourcetype=serverside) earliest=1h@h 
| eval sessionID=coalesce(session_c, session_S) 
| stats values(session_c) as session_c values(session_S) as session_s dc(index) as indexes by sessionID
| where indexes=1

svemurilv
Path Finder

awesome thank you Somesoni2.

0 Karma
Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...