Splunk Search

How to search if a user in Log A also appears in Log B?

eichfuss
Path Finder

Hi community,

propably a simple question, but I still hanging. I need a search over two logfiles, which shows me all users listed in both logs.

Example:

LogA 
TIME, USER, GROUP
14.10.2014 14:03:45, user=Adam, group=alpha
14.10.2014 14:03:35, user=Bert, group=alpha
14.10.2014 14:03:25, user=Conny, group=alpha
14.10.2014 14:03:15, user=Norman, group=beta
14.10.2014 14:03:05, user=Fred, group=beta
14.10.2014 14:02:55, user=John, group=alpha
14.10.2014 14:02:45, user=Steve, group=beta
14.10.2014 14:02:35, user=Bob, group=alpha

LogB 
TIME, USER, DEP
14.10.2014 13:03:45, user=Adam, dep=sales
14.10.2014 13:03:35, user=Gregor, dep=sales
14.10.2014 12:03:25, user=Conny, dep=sales
14.10.2014 13:03:15, user=Jeff, dep=marketing
14.10.2014 12:03:05, user=Fred, dep=marketing
14.10.2014 13:02:55, user=Paul, dep=marketing
14.10.2014 13:02:45, user=Steve, dep=sales
14.10.2014 13:02:35, user=Rod, dep=sales

Now show me all Users which are in LogB and in LogA. (Adam, Conny, Fred, Steve)
Surely a simple search, so sorry for this question. 🙂

Thanks a lot
Cheers, Sven

0 Karma
1 Solution

eichfuss
Path Finder

I found a solution, not really nice but it does the job.

index=test source="/opt/test_logs/logB.log" OR source="/opt/test_logs/logA.log" | transaction fields=user | search source="/opt/test_logs/logA.log" AND source="/opt/test_logs/logB.log" | table user

View solution in original post

eichfuss
Path Finder

I found a solution, not really nice but it does the job.

index=test source="/opt/test_logs/logB.log" OR source="/opt/test_logs/logA.log" | transaction fields=user | search source="/opt/test_logs/logA.log" AND source="/opt/test_logs/logB.log" | table user

aweitzman
Motivator

Something like this should get you started:

source="LogA" [search source="LogB" | table user | dedup user] | table user | dedup user

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...