All Apps and Add-ons

compare two search in a postprocess

sbsbb
Builder

I have two search :
- 1. dbquery
- 2. dbquery

I want being able to compare the results in a postprocess , can I do that ?
I guess Postprocess module is not able to have two parent searches, and handle that...

Or should I use a search, with a join or append, and load the searches with there $searchId$s ?

like :
search1: | dbquery k "SELECT * from x"
search2: | dbquery j "SELECT * from z"
search3: loadjob $search1_id$ append [loadjob $search2_id$]

?

0 Karma
1 Solution

dart
Splunk Employee
Splunk Employee

You're right in that you can't postprocess from two searches. I'd want to test your proposed approaches, but in theory either just appending to a search as a postprocess or loading the jobs should work.

View solution in original post

0 Karma

dart
Splunk Employee
Splunk Employee

You're right in that you can't postprocess from two searches. I'd want to test your proposed approaches, but in theory either just appending to a search as a postprocess or loading the jobs should work.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...