Building for the Splunk Platform

Creating a comparison report

mahbs
Path Finder

Hi,

I'm trying to create report, where I am extracting data from two different sources. This data being extracted from both sources share the same item number value. So the structure is something like this:

ITEM | src1 Field 1 | src1 Field 2 | src2 Field 1 | src2 Field 2
11111 0 0 0 0
12121 8 8 8 8
13222 7 7 7 7

Essentially, what I want to do is extract data from both sources for the relevant fields for a specific ITEM.

Can someone suggest what I can do to achieve this?

EDIT:
Apologies, I haven't been able to seperate the values for each fields. Basically, Each src field has only on Integer value.

Tags (1)
0 Karma
1 Solution

mayurr98
Super Champion

Hey

If you have different field name for both sources then try this:

source=source1 OR source=source2 ITEM=<item_number> | stats values(src1_field1) as "src1_field1"  values(src1_field2) as "src1_field2"  values(src2_field1) as "src2_field1" values(src2_field2) as "src2_field2" by ITEM 

I hope this helps you!

View solution in original post

mayurr98
Super Champion

Hey

If you have different field name for both sources then try this:

source=source1 OR source=source2 ITEM=<item_number> | stats values(src1_field1) as "src1_field1"  values(src1_field2) as "src1_field2"  values(src2_field1) as "src2_field1" values(src2_field2) as "src2_field2" by ITEM 

I hope this helps you!

mayurr98
Super Champion

Also for fast result you should write

index=export14 ITEM=$item_number$". sourcetype=csv | stats values(src1_field1) as field1 values(src1_field2) as field2 BY ITEM | rename ITEM as item_number | map search = "search index=export8 sourcetype=csv src2_item=$item_number$" | stats values(src2_field1) as field1 values(src2_field2) as field2 BY src2_item| rename src_item as item_number 
0 Karma

mahbs
Path Finder

Hi @mayurr98,

Quick question, what does ITEM= do? I understand with the others, you're displaying the values of the fields according to ITEM.

0 Karma

mahbs
Path Finder

@mayurr98,

Apologies, I should have mentioned, the fields from the two different sources will have the same name.

0 Karma

mayurr98
Super Champion

Try this then:

 index=<your_index> source=source1 ITEM=<item_number> field1=* field2=* | stats values(field1) as "src1_field1"  values(field2) as "src1_field2"  by ITEM | join ITEM [search index=<your_index> source=source2 ITEM=<item_number> field1=* field2=* | stats values(field1) as "src2_field1"  values(field2) as "src2_field2"  by ITEM] 

so your output will be
ITEM src1_field1 src1_field2 src2_field1 src2_field2
1111 0 0 0 0
2222 1 1 1 1

Let me know if this works!

0 Karma

mahbs
Path Finder

Will do! Thanks for your speedy response @mayurrr98! 🙂

0 Karma
Get Updates on the Splunk Community!

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Want a chance to win $500 to the Splunk shop? Take our IT Incident Management Survey!

  Top Trends & Best Practices in Incident ManagementSplunk is partnering up with Constellation Research to ...