Splunk Search

How to search two different values in different text files which has same index?

gladiatorankit
Explorer

How to search two different values both the values are in different text files which has the same index and the final output want to route to a different txt file.

Tags (1)
0 Karma
1 Solution

gfuente
Motivator

Something like:

index="commonindex" (source="source1" field1="value1") OR (source="source2" field1="value2")

???

View solution in original post

gfuente
Motivator

Something like:

index="commonindex" (source="source1" field1="value1") OR (source="source2" field1="value2")

???

gladiatorankit
Explorer

Yes this worked. Thanks alot. Actually I have 1 value in File A and another in File B. I want to combine the search result and route it to different file. Please tell me how should I route the result to different file?

0 Karma

gfuente
Motivator

index=main (source="123.txt" "123") OR (source="456.txt" "456")

Im sorry, but i don´t understand what you need.

gladiatorankit
Explorer

I have two text files 123.txt and 456.txt and the values are 123 and 456 in the respective files.

I want to search such that both the files should appear when searched using values "123" and "456" and I want the output "123456" in another file.

0 Karma

gfuente
Motivator

Then:

index=main (source="source1" OR source="source2") 123

Is this what you are looking for?

0 Karma

gladiatorankit
Explorer

Well this is exactly not working. I can only search for one value how will I search for another one?
My search :-
index=main source="F:\123.txt" 123
But what if I want to add one more different source and search in that too?

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...