Hi @gcusello ,
Thanks for your response, for example;
index=windows_server source=AD_Enabled_Server |dedup hostname|eval checker=0 |join type=outer hostname [search index=logsource source="/root/xxx/aaa.txt" |eval checker=1]|table hostname,checker|search checker=0
Every week this search runs and I get the results. But if the result is different, I want to create a structure like open a ticket.
Thanks
Hi @btluynk,
always remember that Splunk isn't a database and the join command must be used only when you haven't any other solution because it's a very slow and resource consuming command.
Let me understand: you want to find the hostname in windows and in logsource, but if you use the condition checker=0, you always have results, what do you want really find: the list of hostanems every week?
Anyway, your original search can be done using stats in this way:
(index=windows_server source=AD_Enabled_Server) OR (index=logsource source="/root/xxx/aaa.txt")
| stats dc(index) AS index_count values(index) AS index BY hostname
| where index_count=1 AND index=windows
If instead you want to find the hostname in windows that are also in logsource, you can use :
index=windows_server source=AD_Enabled_Server [ search index=logsource source="/root/xxx/aaa.txt") | fields hostname ]
this search has only the limit of 50,000 results in the subsearch.
Ciao.
Giuseppe
Hi @btluynk,
if you already created the search, please share it, otherwise, please share the sample data highlighting the fields to compare.
Ciao.
Giuseppe