Splunk Search

search & sub search to match on valu-

himynamesdave
Contributor

I'm trying to create a search to validate two files match on a given field.

I want to check the all the event numbers (a field in the event) in one log file (source1) match to another log file (source2) (event timestamps are identical between log files).

In Splunk I have fields log1_num (source1) and log2_num (source 2) representing the event numbers I am looking to match on. I know I need to run a sub-search to separate the sources first, but my question is how do I then match on fields?

Thanks!

Tags (2)
0 Karma
1 Solution

gfuente
Motivator

Hello

Try with join like:

yoursearch | join _time [subsearch] | eval to compare fields | ...

Given that the timestamp are identical in both sources

Regards

View solution in original post

gfuente
Motivator

Hello

Try with join like:

yoursearch | join _time [subsearch] | eval to compare fields | ...

Given that the timestamp are identical in both sources

Regards

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...