We have ingested into Splunk logs from our application - these logs include two keys - stageType and correlation id, along with other keys. I have to find a list of correlation ids that are returned for one stageType and not for other stageType. I realise Splunk queries cannot be written similar to SQL I am not very conversant with Splunk - I just normally get by - using simpler queries.
Hence hoping, someone can help me with a query that gives me the list - so I can do further analysis to find out the reason for differences, which should not normally exist.
Is it possible to do it in Splunk? Can someone help me with the query?
index=grp-applications sourcetype="kafka:status" stageType IN ("STAGEA", "STAGEB" ) env=qa | dedup env, correlationId, stageType | stats count by env, correlationId, stageType
... View more