About MrFaria25

MrFaria25 · ‎02-18-2023

It's simple. What I wanna do is the difference operation between two sets: to get every item that is in A but not in B. And I use the id to differentiate the logs: First set 1 - 4545-3a4a5bec route1 Payload OK Second set 1 - 4545-3a4a5bec route2 Payload OK In the situation above the id exists in two sides then the results of difference operation is 0. But in the situation below: First set 4545-3a4a5bec route1 Payload OK Second set 2535-6a3f5bab route2 Payload OK the id of the first set does not exists in the second set then the results of difference operation is 1.

MrFaria25 · ‎02-18-2023

Thank you for spending your time answering me. I appreciate. When I do this: index=anything source=anything route1 Payload OK | rex field=_raw "\:[0-9]{4} \- (?<IDROUTE1>[0-9a-f{8}) \-" | table IDROUTE1 Splunk show me the id of each log. But I can take off that part of my search. I was only using it to debug the query because it showed me the id of each log. What matters to me is the calculation that is made. Yeah, I need there to be a relationship between the two searches. Something like that: 4545-3a4a5bec route1 Payload OK 4545-3a4a5bec route2 Payload OK That 2 logs above I want to count(route1 and route2 increment) because the id of route1 exists in id of route2 but when: 4545-3a4a5bec route1 Payload OK 2535-6a3f5bab route2 Payload OK The id of route1 dont exists in route2 I want only to count route1 and not increment route2

MrFaria25 · ‎02-18-2023

Thanks a lot, Giuseppe, for your answer. In the moment I can't to test your query but I think it's right. One doubt: index=anything source=anything Payload OK (route1 OR route1) | rex field=_raw "\:[0-9]{4} \- (?<IDROUTE>[0-9a-f{8}) \-" It's give me only route1 Payload OK and route2 Payload OK(that are 2 strings from diferrent logs) when o id are equal? Ex: 4545-3a4a5bec route1 Payload OK 4545-3a4a5bec route2 Payload OK That 2 logs above I want to count(route1 and route2 increment) because the id of route1 exists in id of route2 but when: 4545-3a4a5bec route1 Payload OK 2535-6a3f5bab route2 Payload OK The id of route1 dont exists in route2 I want only to count route1 and not increment route2. Thanks again!

MrFaria25 · ‎02-17-2023

I'm creating a query where I want to get an id from a log in one side (first search) and in the second search I just want to bring the results that have the ids of the first search. Then I want to calculate the difference between them. Something like: index=anything source=anything route1 Payload OK | rex field=_raw "\:[0-9]{4} \- (?<IDROUTE1>[0-9a-f{8}) \-" | stats count(_raw) as CROUTE1 | table IDROUTE1 | appendcols [search index=anything source=anything route2 Payload OK | rex field=_raw "\:[0-9]{4} \- (<IDROUTE2>[0-9a-f{8}) \-" | stats count(_raw) as CROUTE2 | table IDROUTE2] | where IDROUTE1=IDROUTE2 | eval TOTAL=CROUTE1-CROUTE2 | table TOTAL what is not working is to count the events using where I guess. Searches when done separately bring me the correct results. In Events show me a correct number of events but in Statistics show me 0.

Posts	4
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎02-17-2023

Online Status	Offline
Date Last Visited	‎02-19-2023 12:48 AM

Looking for matching events with "where" and calcu...

Re: Looking for matching events with where and cal...

Re: Looking for matching events with where and cal...

Re: Looking for matching events with where and cal...

Looking for matching events with "where" and calcu...