Splunk Search

Display only values found in two searches

atl215
New Member

index=rap sourcetype="joyner lucas"
| dedup albums| table albums
|append [search index=country sourcetype="lil Nas"
|dedup songs| table songs]

Tags (1)
0 Karma
1 Solution

adonio
Ultra Champion

try this:

(index=rap sourcetype="joyner lucas" albums=*) OR (index=country sourcetype="lil Nas" songs=*)
| eval check_match = coalesce(albums,songs)
| stats count by check_match 
| where count > 1

here is an example to try anywhere:

| makeresults count=1
| eval data = "x,y,z,123;;;x,y,z,124;;;x,y,z,125;;;x,y,z,126;;;a,b,c,123;;;a,b,c,134;;;a,b,c,125;;;a,b,c,136"
| makemv delim=";;;" data 
| mvexpand data
| rex field=data "(?<idx>[^\,]+)\,(?<st>[^\,]+)\,(?<letter>[^\,]+)\,(?<number>.+)"
| eval album = if(idx=="x",number,null())
| eval song = if(idx="a",number,null())
| table idx st album song
| rename COMMENT as "the above generates data below is the solution" 
| search (idx=x st=y album=*) OR (idx=a st=b song=*)
| eval check_match = coalesce(album,song)
| stats count by check_match
| where count > 1

hope it helps

View solution in original post

0 Karma

atl215
New Member

From this answer, how would I chart the matches of this search?

 (index=rap sourcetype="joyner lucas" albums=*) OR (index=country sourcetype="lil Nas" songs=*)
 | eval check_match = coalesce(albums,songs)
 | stats count by check_match 
 | where count > 1
0 Karma

adonio
Ultra Champion

try this:

(index=rap sourcetype="joyner lucas" albums=*) OR (index=country sourcetype="lil Nas" songs=*)
| eval check_match = coalesce(albums,songs)
| stats count by check_match 
| where count > 1

here is an example to try anywhere:

| makeresults count=1
| eval data = "x,y,z,123;;;x,y,z,124;;;x,y,z,125;;;x,y,z,126;;;a,b,c,123;;;a,b,c,134;;;a,b,c,125;;;a,b,c,136"
| makemv delim=";;;" data 
| mvexpand data
| rex field=data "(?<idx>[^\,]+)\,(?<st>[^\,]+)\,(?<letter>[^\,]+)\,(?<number>.+)"
| eval album = if(idx=="x",number,null())
| eval song = if(idx="a",number,null())
| table idx st album song
| rename COMMENT as "the above generates data below is the solution" 
| search (idx=x st=y album=*) OR (idx=a st=b song=*)
| eval check_match = coalesce(album,song)
| stats count by check_match
| where count > 1

hope it helps

0 Karma

atl215
New Member

I would like to list the values that match

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...