Splunk Search

Calculate Difference Between Outputs of two Scheduled Searches

jodros
Builder

I have two scheduled searches that each output a single numerical value to populate panels on a dashboard. I want to add a third panel to simply show the difference between the two. I have read several threads on splunk answers but none have helped me with this issue. Each search is somewhat complex and takes a bit of time to run, so I scheduled them to run and cache their results for the dashboard. I have read and tried using savedsearch and append. I have also tried to utilize OR and eval. I have read where using join is discouraged. Best case would be to simply take the already ran results and simply eval them, without have to run both searches again.

Any assistance would be appreciated. Thanks.

Edit:
Would it help if I included the searches that are running on a schedule?
Search 1:

`sourcetype=a tag=prod | dedup c_uid | stats count(c_uid)`

Search 2:

`sourcetype=a tag=prod [search sourcetype=b tag=prod audit_event="AUTHN_SUCCESS" | dedup b_uid | fields b_uid | format maxresults=20000] | dedup c_uid | stats count(c_uid)`

Search 1 will always be more than search 2, and I would like to show that difference in a panel on the dashboard. The other alternative is not to show the difference and just let the VP do the math, which isn't a good option.

Thanks!

1 Solution

Ayn
Legend

I think this should work:

| loadjob savedsearch="user:app:yoursavedsearch" | append [| loadjob savedsearch="user:app:yourothersavedsearch"] | delta count(c_uid) as diff

This will create the field "diff" that you could show in a panel.

View solution in original post

Ayn
Legend

I think this should work:

| loadjob savedsearch="user:app:yoursavedsearch" | append [| loadjob savedsearch="user:app:yourothersavedsearch"] | delta count(c_uid) as diff

This will create the field "diff" that you could show in a panel.

flo_cognosec
Communicator

Interesting enough I can't seem to find the necc. job-id's and when using the names of scheduled saved searches, I get the error message that no search artifacts could be found even though the searches ran and can be viewed.
Is a stats command in the saved searches a problem ?

0 Karma

jodros
Builder

Thank you! I knew it would be something simple like that. I modified your suggestion slightly but it works great.

| loadjob savedsearch="user:app:yoursavedsearch" | append [| loadjob savedsearch="user:app:yourothersavedsearch"] | stats range(count(c_uid) as diff

This allows me not to have to worry about negative integers.

Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...