I have 3 sources source1, source2, source3 and 5 sourcetypes sourcetype1, sourcetype2, sourcetype3, sourcetype4, sourcetype5 for a single host host1. Where sourcetype1 belongs exclusively to source1 and sourcetype2 to source2 but source3 has 3 sourcetypes; sourcetype3, sourcetype4 and sourcetype5. Likewise, I have 2 sources source4, source5 and 3 sourcetypes sourcetype6, sourcetype7, sourcetype8 for another host host2. With source4 having sourcetype6 and source5 having sourcetype7 and sourcetype8. I wish to have a stats count like this: --------------------------------------- host source sourcetype --------------------------------------- host1 source1 sourcetype1 host1 source2 sourcetype2 host1 source3 sourcetype3 host1 source3 sourcetype4 host1 source3 sourcetype5 host2 source4 sourcetype6 host2 source5 sourcetype7 host2 source5 sourcetype8 Can someone please help? ... View more

Hi, I need to join two splunk search queries based on a common field (JoinId). All I would like to have at the output is to return how many values of that particular common field is mapped from both queries and how many are unmapped from query2. Can someone help me with this? query1: index="source1" "layer-monitor" ServiceEvent "debug"| search NOT ErrorMessage=* | stats count(JoinId) as "Total success" query2: index="source2" sourcetype="sourceData" "Message=Log Message invoked" JoinId I would like to know how many JoinId fields of query2 are unmapped with respect to query1 JoinId ... View more