Splunk Search

Calculate Difference Between Outputs of two Scheduled Searches

jodros
Builder

I have two scheduled searches that each output a single numerical value to populate panels on a dashboard. I want to add a third panel to simply show the difference between the two. I have read several threads on splunk answers but none have helped me with this issue. Each search is somewhat complex and takes a bit of time to run, so I scheduled them to run and cache their results for the dashboard. I have read and tried using savedsearch and append. I have also tried to utilize OR and eval. I have read where using join is discouraged. Best case would be to simply take the already ran results and simply eval them, without have to run both searches again.

Any assistance would be appreciated. Thanks.

Edit:
Would it help if I included the searches that are running on a schedule?
Search 1:

`sourcetype=a tag=prod | dedup c_uid | stats count(c_uid)`

Search 2:

`sourcetype=a tag=prod [search sourcetype=b tag=prod audit_event="AUTHN_SUCCESS" | dedup b_uid | fields b_uid | format maxresults=20000] | dedup c_uid | stats count(c_uid)`

Search 1 will always be more than search 2, and I would like to show that difference in a panel on the dashboard. The other alternative is not to show the difference and just let the VP do the math, which isn't a good option.

Thanks!

1 Solution

Ayn
Legend

I think this should work:

| loadjob savedsearch="user:app:yoursavedsearch" | append [| loadjob savedsearch="user:app:yourothersavedsearch"] | delta count(c_uid) as diff

This will create the field "diff" that you could show in a panel.

View solution in original post

Ayn
Legend

I think this should work:

| loadjob savedsearch="user:app:yoursavedsearch" | append [| loadjob savedsearch="user:app:yourothersavedsearch"] | delta count(c_uid) as diff

This will create the field "diff" that you could show in a panel.

flo_cognosec
Communicator

Interesting enough I can't seem to find the necc. job-id's and when using the names of scheduled saved searches, I get the error message that no search artifacts could be found even though the searches ran and can be viewed.
Is a stats command in the saved searches a problem ?

0 Karma

jodros
Builder

Thank you! I knew it would be something simple like that. I modified your suggestion slightly but it works great.

| loadjob savedsearch="user:app:yoursavedsearch" | append [| loadjob savedsearch="user:app:yourothersavedsearch"] | stats range(count(c_uid) as diff

This allows me not to have to worry about negative integers.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...