Splunk Search

Correlating two indexes data

abhayneilam
Contributor

Hi,

I have a correlation ID in one index

( index="AAA" | rex "XXXXXX\]\[(?.*?)\]" )  

which I want to match with the correlation ID of other index ,

( index="BBB" | rex "CCCCCCC\]\[(?.*?)\]" )

Once matched I want to get the total count of how many correlation ID mathces between these two Indexes.

Please help me to get the results.

Tags (2)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi abhayneilam,

based on the provided information, which is by the way very little, try something like this:

index="AAA" OR index="BBB"  
| rex "XXXXXX\]\[(?<myID>.*?)\]" 
| rex "CCCCCCC\]\[(?<myID>.*?)\]" 
| streamstats window=2 last(myID) AS last_myID 
| where myID=last_myID 
| stats count by myID

This should give you an idea or take a closer look at this answer
http://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-joi...

hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi abhayneilam,

based on the provided information, which is by the way very little, try something like this:

index="AAA" OR index="BBB"  
| rex "XXXXXX\]\[(?<myID>.*?)\]" 
| rex "CCCCCCC\]\[(?<myID>.*?)\]" 
| streamstats window=2 last(myID) AS last_myID 
| where myID=last_myID 
| stats count by myID

This should give you an idea or take a closer look at this answer
http://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-joi...

hope this helps ...

cheers, MuS

abhayneilam
Contributor

Thanks a lot !! 🙂

0 Karma

abhayneilam
Contributor

so for both the Indexes , do we need to keep the same filed name as "Correlation_ID"

0 Karma

splunker12er
Motivator

index="AAA" | rex "XXXXXX][(?.?)]" | append [search index="BBB" | "CCCCCCC][(?.?)]" ] | stats count by correlaion_ID

tried this ?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...