Splunk Search

Compare two fields from different sources

gnoellbn
Explorer

Hello,

I'm trying to compare a host field from two different sources. I've managed to do that with the following serach :

source="/home/conf/admin/log/nouveaux_clients.txt" OR source="WinEventLog:Security" | eval common_host=coalesce(hote, host) | stats dc(source) as occur by common_host | where occur>1

This gives me a table with all the fields that exist in both. However I'm trying to find a way to show what is in my first source but isn't in my second.

Hope I was clear enough 😉

Tags (1)
0 Karma

kristian_kolb
Ultra Champion

Ok, this will solve the 'exists only in first' problem.

source="/home/conf/admin/log/nouveaux_clients.txt" NOT [search source="WinEventLog:Security" | dedup host | rename host as hote| fields +hote]| stats values(hote) as only_in_first

/K

0 Karma

gnoellbn
Explorer

I'd say on the same it would be ideal but then if it's not possible we'll manage with two different searches 😉

0 Karma

lukejadamec
Super Champion

Did you want a separate search with its own table, or did you want to modify this search to also include what is in the first by not in the second?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...