Getting Data In

How do I compare the count of the same field from different sources?

WXY
Path Finder

Hi,

Now I have a problem:

I have a index data which has multiple sources and they have the same sourcetype.

index=t_web sourcetype=t_web_pect

source such as :
t_we_a1.txt ,t_we_a2.txt , t_we_a3.txt
They have the same fields, because of source type fields such as: scan_system_name scan_level.

Different sources may have the same scan_system_name
now I want to get a table ,such as :

sys_Name  number of recent scan_level   number of recent scan_level   Compared with the last scan 
name1         66                            60                       More than the last one
name2          57                           68                       Fewer than the last one
name3          34                           34                      The number has't changed

name1 may in multiple sources. I just need to get the same system name.

What should I do?

Tags (2)
0 Karma
1 Solution

WXY
Path Finder

I have solved this problem:

index=t_web
| stats count(scan_level) as levelcount by scan_system_name  _time 
| streamstats latest(levelcount) as a by scan_system_name  current=f 
| fillnull value=0 a 
| eval aa = levelcount-a 
| stats latest(_time) as _time latest(a) as lastCount latest(levelcount) as finalScan  count as scanCount latest(aa) as ComparedWithLast by scan_system_name
| eval ComparedWithLast  = CASE ( 'scanCount'==1, "Only Scan One", ('scanCount'>1 and 'ComparedWithLast'>0), "More than the last one", 'ComparedWithLast'<0, "Fewer than the last one", ('scanCount'>1 and 'ComparedWithLast'==0), "The number has't changed")

View solution in original post

0 Karma

WXY
Path Finder

I have solved this problem:

index=t_web
| stats count(scan_level) as levelcount by scan_system_name  _time 
| streamstats latest(levelcount) as a by scan_system_name  current=f 
| fillnull value=0 a 
| eval aa = levelcount-a 
| stats latest(_time) as _time latest(a) as lastCount latest(levelcount) as finalScan  count as scanCount latest(aa) as ComparedWithLast by scan_system_name
| eval ComparedWithLast  = CASE ( 'scanCount'==1, "Only Scan One", ('scanCount'>1 and 'ComparedWithLast'>0), "More than the last one", 'ComparedWithLast'<0, "Fewer than the last one", ('scanCount'>1 and 'ComparedWithLast'==0), "The number has't changed")
0 Karma

woodcock
Esteemed Legend

I do not understand your situation. If you will give a small set of sample data and the desired output (perhaps with commentary on how the normal way of doing it would give the wrong output and show the wrong output), then I will try to help.

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

hi @WXY

Are you still having trouble with this issue? If so, please answer the commenter above so that they can help you further. There is also an answer below — did you try out their solution? Or, if you solved your query on your own, please describe the steps you took so that others can learn from your solution.

Thanks.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Use some conditional logic like this

| eval count_source_one=if(SOURCE1=source1, 'count',"")
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...