Dashboards & Visualizations

How to display fields from two different sources using FieldSummary

mahbs
Path Finder

Hi

I have two different sources, Im trying to display the fields present in both those sources to verify what fields they contains.

This is what I have so far:

index=drv (sourcetype=xxx OR sourcetype=yyy) NOT host="oo" | fieldsummary | eval test="xxx" | eval reference="yyy" | table field test field reference 

I know it's wrong, but that's where I am at the moment. I need to have multiple "fields".
I also would like to know how I can count the number of fields present in both source types

Thanks!

Tags (1)
0 Karma

woodcock
Esteemed Legend

Maybe this:

 index=drv (sourcetype=xxx OR sourcetype=yyy) NOT host="oo"
| multreport
[ | search sorucetype=xxx | fieldsummary | eventstats count AS numFields ]
[ | search sorucetype=yyy | fieldsummary | eventstats count AS numFields ]
0 Karma

ybongart_splunk
Splunk Employee
Splunk Employee

Having now read your comment response to @niketnilay...

Also very nasty SPL but just for fun...this gives you what you described:

index=_internal sourcetype=splunkd 
| fieldsummary 
| fields field 
| rename field AS "splunkd fields" 
| append 
    [ search index=_internal sourcetype=splunkd 
    | fieldsummary 
    | fields field 
    | stats count AS "splunkd fields"] 
| appendcols 
    [ search index=_internal sourcetype=mongod 
    | fieldsummary 
    | fields field 
    | rename field AS "mongod fields" 
    | append 
        [ search index=_internal sourcetype=mongod 
        | fieldsummary 
        | fields field 
        | stats count AS "mongod fields"]]

ybongart_splunk
Splunk Employee
Splunk Employee

These may not be super efficient but if you are just exploring the fields in your sourcetypes they should suffice...

If you want to display only the names of fields which appear in both sourcetypes:

| set intersect [search index=_internal sourcetype=splunkd | fieldsummary 
|  fields field]
    [ search index=_internal sourcetype=mongod | fieldsummary 
|  fields field]

And the number of field names they have in common:

| set intersect [search index=oidemo sourcetype=access_combined | fieldsummary 
|  fields field]
    [ search index=oidemo_notable sourcetype=stash | fieldsummary 
|  fields field]
|  stats count

If you want the combined list of field names across both sourcetypes:

(index=_internal sourcetype=splunkd) OR (index=_internal sourcetype=mongod) | fieldsummary 
| fields field

And their number of unique field names across both sourcetypes:

(index=_internal sourcetype=splunkd) OR (index=_internal sourcetype=mongod) | fieldsummary 
| fields field
| stats count
0 Karma

niketn
Legend

@mahbs, I think for the community to assist you, you would need to provide more details. Can you add which fields from respective source are you interested in. What is the desired output and what is your use case?

Maybe add current output and state what is wrong and what would be correct output.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

mahbs
Path Finder

Hi, I'm interested in all the fields associated to the sourcetype. Want I want is those fields to be displayed in a table format for both sourcetypes as well as a count, for the total number of fields for each sourcetype.

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...