Hello ,
I have data from 2 diff source with same fields as shown below :
index= sourcetype= source= test.txt
device_name="alpha" pool_name="a"
device_name="beta" pool_name="b"
device_name="gamma" pool_name="c"
index= sourcetype= source=test1.txt
device_name="alpha" pool_name="a"
device_name="beta" pool_name="b"
device_name="gamma" pool_name="z"
eval actual_pools = toString(device_name) + ";" + toString(pool_name)
I am looking for field actual_pools using raw data which i created above which exist in source=test1.txt but not in source=test.txt
Thanks
Hi,
start with an empty search. First, we have to recreate your data:
| makeresults | eval device_name="alpha,beta,gamma" | makemv delim="," device_name |mvexpand device_name | eval pool_name=if(device_name="gamma","c",substr(device_name,1,1))
Then we add a field that holds the source of the pool_name:
| eval pool_source="text1"
| append [| makeresults | eval device_name="alpha,beta,gamma" | makemv delim="," device_name |mvexpand device_name | eval pool_name=if(device_name="gamma","z",substr(device_name,1,1)) | eval pool_source="text2"]
Next you append the events from the second query and give it a different pool_source as the last command in the subquery:
| transaction pool_name,device_name``
Now you can use transaction to combine the results:
In the end it looks like this:
It doesn't work may be because sorry I think i didn't put question in Splunk language there are not files but source of date , changed details below as per splunk names :
I have data from 2 diff source with same fields as shown below :
index=* sourcetype=* source= test.txt
device_name="alpha" pool_name="a"
device_name="beta" pool_name="b"
device_name="gamma" pool_name="c"
index=* sourcetype=* source=test1.txt
device_name="alpha" pool_name="a"
device_name="beta" pool_name="b"
device_name="gamma" pool_name="z"
eval actual_pools = toString(device_name) + ";" + toString(pool_name)
I am looking for field actual_pools using raw data which i created above which exist in source=test1.txt but not in source=test.txt . Thanks for help .