Splunk Search

get the list of keyword values which is present in one query and not present in second query

dsha
Engager

we have two queries . both the queries have same keyword with value.so we would like to list the values of the keyword which are present in first query and the same keyword value's not present in the second query

query 1:
index=storeapp "Received the content for checking further"
query 2:
index=storeapp "Successfully completed the check and returned back the result

both the query events have common keyword with value as ASSETID=12345 .so here we would like to get the list of values which are present in one query and the same value not present in second query.

0 Karma

Richfez
SplunkTrust
SplunkTrust

Without a sample, this is a bit harder. But try in general combining the two into one thing, grouping on ASSETID with a count, then just selecting those with a count of 1. The idea would be that if it had both items, count would be two, if it had only one, it would have one.

I'm going to assume there's a field called, let's say "message" that is the contents of those strings, so a message of "Received the content for checking further" and one message of "Successfully completed the check and returned back the result". If this is not the case, you should create those extractions. Or you could built a tag for them. Or event type. Whatever, something like that.

So, perhaps, again assuming the field message as described above:

search index=storeapp (message="Received the content for checking further" OR message="Successfully completed the check and returned back the result")
| stats count, list(message) BY ASSETID
| search count>1

This may or may not work as is - probably not, but again we don't have sample events to really work with here. You give us pseudo-events, we give you pseudo-answers. 🙂

Anyway, I do hope that helps! Do write back with more detail if this isn't what you need, or if it's half of it but not quite perfect yet.

Happy Splunking,
Rich

0 Karma

bandit
Motivator

Would be helpful to have some sample records.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...