How to compare to searches in different indexes?

[mkelderm]

How can I compare two or more source-types (each source-type has a unique index) with each other? Each source-type has errors, I want to count the number of errors on each source-type and compare them with each other over a period.

I thought:

(index=iplan AND sourcetype=iplan AND Error) | eval bron=1 | append [ search (index=web AND sourcetype=access-kim AND Error) | eval bron=2 ] | timechart count(bron) by bron | fields bron, count(bron)

But this is not working 😞

[kristian_kolb · Accepted solution]

Without having seen your actual log data, and making some assumptions regarding your desired output...do you relly need an append?

(index=iplan sourcetype=iplan) OR (index=web sourcetype=access-kim) Error | timechart count by sourcetype

You could further simplify by removing the index= statements IF both of those indexes are searched by default, and those sourcetypes are not present in other indexes also searched by default.

If this doesn't help, please supply some sample events, and a more detailed description of the output you want.

hope this helps,

Kristian

[tgow]

Without looking at your data you might be able to shorten this up a bit. Remember that just like Google, the Splunk search has an inherent boolean "AND" so you do not need to state it. Also if you are going to have an eval statement then the variables need to be unique.

index=iplan sourcetype=iplan Error | eval bron=1 | append [ search index=web sourcetype=access-kim  Error | eval bron2=2 ] | timechart count(bron) by bron2 | fields bron, count(bron2)