Splunk Search

How to search if a user in Log A also appears in Log B?

eichfuss
Path Finder

Hi community,

propably a simple question, but I still hanging. I need a search over two logfiles, which shows me all users listed in both logs.

Example:

LogA 
TIME, USER, GROUP
14.10.2014 14:03:45, user=Adam, group=alpha
14.10.2014 14:03:35, user=Bert, group=alpha
14.10.2014 14:03:25, user=Conny, group=alpha
14.10.2014 14:03:15, user=Norman, group=beta
14.10.2014 14:03:05, user=Fred, group=beta
14.10.2014 14:02:55, user=John, group=alpha
14.10.2014 14:02:45, user=Steve, group=beta
14.10.2014 14:02:35, user=Bob, group=alpha

LogB 
TIME, USER, DEP
14.10.2014 13:03:45, user=Adam, dep=sales
14.10.2014 13:03:35, user=Gregor, dep=sales
14.10.2014 12:03:25, user=Conny, dep=sales
14.10.2014 13:03:15, user=Jeff, dep=marketing
14.10.2014 12:03:05, user=Fred, dep=marketing
14.10.2014 13:02:55, user=Paul, dep=marketing
14.10.2014 13:02:45, user=Steve, dep=sales
14.10.2014 13:02:35, user=Rod, dep=sales

Now show me all Users which are in LogB and in LogA. (Adam, Conny, Fred, Steve)
Surely a simple search, so sorry for this question. 🙂

Thanks a lot
Cheers, Sven

0 Karma
1 Solution

eichfuss
Path Finder

I found a solution, not really nice but it does the job.

index=test source="/opt/test_logs/logB.log" OR source="/opt/test_logs/logA.log" | transaction fields=user | search source="/opt/test_logs/logA.log" AND source="/opt/test_logs/logB.log" | table user

View solution in original post

eichfuss
Path Finder

I found a solution, not really nice but it does the job.

index=test source="/opt/test_logs/logB.log" OR source="/opt/test_logs/logA.log" | transaction fields=user | search source="/opt/test_logs/logA.log" AND source="/opt/test_logs/logB.log" | table user

aweitzman
Motivator

Something like this should get you started:

source="LogA" [search source="LogB" | table user | dedup user] | table user | dedup user

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...