About ikenahim7

ikenahim7 · ‎08-02-2022

This wont work, my actual values are move then 30K targets! the tables above was just to explain my logic how i want to compare both queries. each query returns around 12k targets

ikenahim7 · ‎08-02-2022

Hi, I have two search queries which results in table as follow: | search query1 | table type1 platform1 target1 type1 platform1 target1 X WIN path/cpp X None path/c X LINUX path/py | search query2 | table type2 platform2 target2 type2 platform2 target2 Z WIN path/cpp Z LINUX path/cpp (Target are unique based on their full path) How I can compare both tables . by making left join between both tables and comparing, such that : -> join both tables where first query table is the lead when comparing against, left join I believe ? -> Count as match only IF target from first query where platform = WIN , exists in second table where platform = WIN -> Count as match only IF target from first query where platform = LINUX, exists in second table where platform = LINUX -> Count as match only IF target from first query where platform = NONE, exists in second table for both platform = LINUX and platform = WIN else no match Then list results in table with total matching target, total missing target, total target for type X , total target for type Z . How I can reach this ? Thanks 🙂

ikenahim7 · ‎07-31-2022

Thanks a lot, query looks as expected 🙂

ikenahim7 · ‎07-31-2022

The query works as expected thanks a lot. If I want to extend the query to ignore some paths based on a string value , how i can achieve that ? assuming I have: {"source":"build","sourcetype":"json","event":{"type":"bazel","paths":["test1.cpp", "test3.c"]}} {"source":"build","sourcetype":"json","event":{"type":"gradle","paths":["test2.cpp", "test3.py"]}} Comparing this two I want to ignore path with extension ".cpp" from being used while comparing Gradle with Bazel ?, so the total account of Gradle path wont count paths with .cpp and also wont be list in diff_values ? Thanks 🙂

ikenahim7 · ‎07-30-2022

I meant by matches, paths that are common for both type gradle and bazel. so the idea is to show number of paths for each type (bazel and gradle) show the number of common paths between bazel and gradle and show the actual paths value that are common shows the number of paths that aren’t common and show the actual paths thats aren't common.

ikenahim7 · ‎07-30-2022

Im extending the query if you can help - see https://community.splunk.com/t5/Splunk-Search/Compare-two-search-results-and-list-difference-and-matches/m-p/607622#M211277 🙂 thanks

ikenahim7 · ‎07-30-2022

Hi guys im new to Splunk, Im trying to write a query to compare two search results and shows the differences and the matches, both search results are coming from the same index. I would like to have something like this, where {path-values} hold the paths values and {countpath} holds the count. Build-type | paths-count | matches-values | diff-values | matches-count | diff-count| gradle | 20K | {path-values} | {path-values} | {countpath} | {countpath} bazel | 10K | {path-values} | {path-values} | {countpath} | {countpath} my index is based on this json, where total event is a 30k (number of json posted to splunk) {"source":"build","sourcetype":"json","event":{"type":"bazel","paths":["test3"]}} my current query looks like: index="build" type="bazel" | stats values(paths{}) as paths | stats count(eval(paths)) AS totalbazelpaths | mvexpand totalbazelpaths | eval eventFound = 0 | join type=left run_id paths [ index="build" type="gradle" | stats values(paths{}) as paths | stats count(eval(paths)) AS totalgradlepaths | mvexpand totalgradlepaths | eval eventFound=1] | eval percentage = round(totalbazelpaths/totalgradlepaths, 10) | table totalgradlepaths totalbazelpaths percentage any help how to achieve this? @yuanliu Thanks

ikenahim7 · ‎07-30-2022

The issue was with Splunk instance was limited to read 1000 character only. thanks for helping tho

ikenahim7 · ‎07-28-2022

I tried index="build-report" run_id="1" type="bazel" | eval totalpaths = mvcount('paths{}') | table totalpaths returns 235 instead of 11k . what could be causing this ?

ikenahim7 · ‎07-28-2022

Just tried it doesnt return any value index="build_report" run_id="1" type="gradle" | rename paths{} as path | eval path_count=mvcount(split(path,","))-1 | table path_count empty table 😕

ikenahim7 · ‎07-28-2022

Hi, I have a json coming from CI with this template : {"source":"1","sourcetype":"json","event":{"type":"build","id":"061","durartion":"48","run_id":"1","paths":["value1",".value2","value3"]} the filed are listed in splunk as: id, duration, sourcetype, paths{} and i can list all the values but my issue is i want to count paths{} (more then 11k values) I tried using mvcount as | eval totalpaths = mvcount(paths) retuns nothing | eval totalpaths = mvcount(paths{}) return 1 is there a way how i can return the number of total path ? how i can list all paths ? I tried using | stats values(paths{}) as paths | stats count(eval(paths)) AS totalbazelpaths returns 378 while the actual value is above 11k. when expanding paths{} field I can see all 11k paths. what im doing wrong here? thanks

Posts	11
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎07-28-2022

Online Status	Offline
Date Last Visited	‎08-03-2022 11:54 AM

How do I compare two tables based on a logic?

How to compare two search results and list differe...

How to search number of total path in multivalue f...

Re: How do I compare two tables based on a logic?

How do I compare two tables based on a logic?

Re: How to compare two search results and list dif...

Re: Compare two search results and list difference...

Re: Compare two search results and list difference...

Re: How to search number of total path in multival...

How to compare two search results and list differe...

Re: issue with multivalue field

Re: issue with multivalue field

Re: issue with multivalue field

How to search number of total path in multivalue f...