Splunk Search

get the list of keyword values which is present in one query and not present in second query

dsha
Engager

we have two queries . both the queries have same keyword with value.so we would like to list the values of the keyword which are present in first query and the same keyword value's not present in the second query

query 1:
index=storeapp "Received the content for checking further"
query 2:
index=storeapp "Successfully completed the check and returned back the result

both the query events have common keyword with value as ASSETID=12345 .so here we would like to get the list of values which are present in one query and the same value not present in second query.

0 Karma

Richfez
SplunkTrust
SplunkTrust

Without a sample, this is a bit harder. But try in general combining the two into one thing, grouping on ASSETID with a count, then just selecting those with a count of 1. The idea would be that if it had both items, count would be two, if it had only one, it would have one.

I'm going to assume there's a field called, let's say "message" that is the contents of those strings, so a message of "Received the content for checking further" and one message of "Successfully completed the check and returned back the result". If this is not the case, you should create those extractions. Or you could built a tag for them. Or event type. Whatever, something like that.

So, perhaps, again assuming the field message as described above:

search index=storeapp (message="Received the content for checking further" OR message="Successfully completed the check and returned back the result")
| stats count, list(message) BY ASSETID
| search count>1

This may or may not work as is - probably not, but again we don't have sample events to really work with here. You give us pseudo-events, we give you pseudo-answers. 🙂

Anyway, I do hope that helps! Do write back with more detail if this isn't what you need, or if it's half of it but not quite perfect yet.

Happy Splunking,
Rich

0 Karma

bandit
Motivator

Would be helpful to have some sample records.

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...