Splunk Search

How can I get eventstats to recognize a renamed field?

rlough
Path Finder

Hi,

I've been having some trouble grouping same fields from multiple sources when the field names are different. I have two sources that have the same field, but different names and I simply want to table a list of all of those names that are present in both.

For example my search looks something like this:

index=ind (source=src1.log "TAG") OR (source=src2.log ANOTHERTAG) | rex field=_raw mode=sed "s/UserID/nameID/g" | eventstats count(eval(source=="src1.log")) AS src1Count count(eval(source==src2.log)) AS src2Count by nameID | where src1Count > 0 OR src2Count > 0 | table nameID

When the field names are the same and I do not have to include rex field=_raw mode=sed "s/UserID/nameID/g" in the query, it works great! However, the above just returns no events or stats. I have also tried the rename command with no luck.

Thanks in advance!

Note: I definitely want to avoid using subsearch if at all possible.

0 Karma
1 Solution

rsennett_splunk
Splunk Employee
Splunk Employee

You're gonna want to take a look at this moving forward:
Common Information Model Add-On

Personally, I would use Field Alias. settings>field>field alias.
You can apply an alias to source, sourcetype or host.
It won't be clear in your search that you used an alias, but it certainly helps when it's something you'll use over and over again.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!

View solution in original post

0 Karma

rsennett_splunk
Splunk Employee
Splunk Employee

You're gonna want to take a look at this moving forward:
Common Information Model Add-On

Personally, I would use Field Alias. settings>field>field alias.
You can apply an alias to source, sourcetype or host.
It won't be clear in your search that you used an alias, but it certainly helps when it's something you'll use over and over again.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...