All Apps and Add-ons

compare two search in a postprocess

sbsbb
Builder

I have two search :
- 1. dbquery
- 2. dbquery

I want being able to compare the results in a postprocess , can I do that ?
I guess Postprocess module is not able to have two parent searches, and handle that...

Or should I use a search, with a join or append, and load the searches with there $searchId$s ?

like :
search1: | dbquery k "SELECT * from x"
search2: | dbquery j "SELECT * from z"
search3: loadjob $search1_id$ append [loadjob $search2_id$]

?

0 Karma
1 Solution

dart
Splunk Employee
Splunk Employee

You're right in that you can't postprocess from two searches. I'd want to test your proposed approaches, but in theory either just appending to a search as a postprocess or loading the jobs should work.

View solution in original post

0 Karma

dart
Splunk Employee
Splunk Employee

You're right in that you can't postprocess from two searches. I'd want to test your proposed approaches, but in theory either just appending to a search as a postprocess or loading the jobs should work.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...