Splunk Search

map search question

ITSplunk117
Path Finder

I'm using a modified search from splunksearches.com to get the events from the past two days and returning the difference.  For all of the indexes and sourcetypes, if it exists, in the testlookup. 

 While it works the index and sourcetype does not line up with the results.  Mapping I found handles this SPL a little different than a normal search, location of the stats command had to be moved to return the same results.  
My question is there a way to modify the SPL so the index/sourcetype lines up with the results?  I'm pretty sure I'll eventually get it but already spent enough time on this.  
thanks

testlookup: has the columns index and sourcetype  

 

 

 

 

| inputlookup testlookup
|eval index1=index
|eval sourcetype1=if (isnull(sourcetype),"","sourcetype="+sourcetype)
|appendpipe
[|map search="search index=$index1$ earliest=-48h latest=-24h | bin _time span=1d | eval window=\"Yesterday\"| stats count by _time window  | append [|search index=$index1$ earliest=-24h | eval window=\"Today\"| bin _time span=1d | stats count by _time window  | eval _time=(_time-(60*60*24))] | timechart span=1d sum(count) by window|eval difference = abs(Yesterday - Today)"]| table index1 sourcetype1 Yesterday Today difference

 

 

 

 

index1sourcetype1yesterdaytoday difference
test1st_test1   
  102010
     

 

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

map can be slow and limited - try something like this

[| inputlookup testlookup
| table index sourcetype] earliest=-2d@d latest=@d
| eval day=if(_time < relative_time(now(), "-1d@d"), "Yesterday", "Today")
| stats count by day index sourcetype
| eval {day}=count
| stats values(Today) as Today values(Yesterday) as Yesterday by index sourcetype
| fillnull value=0 Yesterday Today
| eval difference=abs(Yesterday - Today)

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

map can be slow and limited - try something like this

[| inputlookup testlookup
| table index sourcetype] earliest=-2d@d latest=@d
| eval day=if(_time < relative_time(now(), "-1d@d"), "Yesterday", "Today")
| stats count by day index sourcetype
| eval {day}=count
| stats values(Today) as Today values(Yesterday) as Yesterday by index sourcetype
| fillnull value=0 Yesterday Today
| eval difference=abs(Yesterday - Today)

ITSplunk117
Path Finder

Thank you this should work quite well for my needs.

 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...