Dashboards & Visualizations

How to display fields from two different sources using FieldSummary

mahbs
Path Finder

Hi

I have two different sources, Im trying to display the fields present in both those sources to verify what fields they contains.

This is what I have so far:

index=drv (sourcetype=xxx OR sourcetype=yyy) NOT host="oo" | fieldsummary | eval test="xxx" | eval reference="yyy" | table field test field reference 

I know it's wrong, but that's where I am at the moment. I need to have multiple "fields".
I also would like to know how I can count the number of fields present in both source types

Thanks!

Tags (1)
0 Karma

woodcock
Esteemed Legend

Maybe this:

 index=drv (sourcetype=xxx OR sourcetype=yyy) NOT host="oo"
| multreport
[ | search sorucetype=xxx | fieldsummary | eventstats count AS numFields ]
[ | search sorucetype=yyy | fieldsummary | eventstats count AS numFields ]
0 Karma

ybongart_splunk
Splunk Employee
Splunk Employee

Having now read your comment response to @niketnilay...

Also very nasty SPL but just for fun...this gives you what you described:

index=_internal sourcetype=splunkd 
| fieldsummary 
| fields field 
| rename field AS "splunkd fields" 
| append 
    [ search index=_internal sourcetype=splunkd 
    | fieldsummary 
    | fields field 
    | stats count AS "splunkd fields"] 
| appendcols 
    [ search index=_internal sourcetype=mongod 
    | fieldsummary 
    | fields field 
    | rename field AS "mongod fields" 
    | append 
        [ search index=_internal sourcetype=mongod 
        | fieldsummary 
        | fields field 
        | stats count AS "mongod fields"]]

ybongart_splunk
Splunk Employee
Splunk Employee

These may not be super efficient but if you are just exploring the fields in your sourcetypes they should suffice...

If you want to display only the names of fields which appear in both sourcetypes:

| set intersect [search index=_internal sourcetype=splunkd | fieldsummary 
|  fields field]
    [ search index=_internal sourcetype=mongod | fieldsummary 
|  fields field]

And the number of field names they have in common:

| set intersect [search index=oidemo sourcetype=access_combined | fieldsummary 
|  fields field]
    [ search index=oidemo_notable sourcetype=stash | fieldsummary 
|  fields field]
|  stats count

If you want the combined list of field names across both sourcetypes:

(index=_internal sourcetype=splunkd) OR (index=_internal sourcetype=mongod) | fieldsummary 
| fields field

And their number of unique field names across both sourcetypes:

(index=_internal sourcetype=splunkd) OR (index=_internal sourcetype=mongod) | fieldsummary 
| fields field
| stats count
0 Karma

niketn
Legend

@mahbs, I think for the community to assist you, you would need to provide more details. Can you add which fields from respective source are you interested in. What is the desired output and what is your use case?

Maybe add current output and state what is wrong and what would be correct output.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

mahbs
Path Finder

Hi, I'm interested in all the fields associated to the sourcetype. Want I want is those fields to be displayed in a table format for both sourcetypes as well as a count, for the total number of fields for each sourcetype.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...