Splunk Search

How to search for field values in a subsearch?

szabados
Communicator

Little strange issue I got...
I ingest files into an index. I want to add a yes/no field to my events, based on if the same event is present in a previous file.

Lets say, I have events with fields likes this:
keyfield1, keyfield2, miscfield1 ... miscfieldN

And I want to do something likes this:

index=myindex source=inputfile1 | eval flag=if([index=myindex source=inputfile2 keyfield1=<value of keyfield1 in the event> AND keyfield2=<value of keyfield2 in the event>],"true","false")

I know the syntax of the if statement is not true, but hope it can articulate my problem.

0 Karma

bmacias84
Champion

This should something best suited for collections or lookups/

0 Karma

woodcock
Esteemed Legend

Try this:

index=myindex source=inputfile1 OR source=inputfile2 | eventstats dc(source) AS DC1 by keyfield1 | eventstats dc(source) AS DC2 by keyfield2 | where source=inputfile1 | eval flag=if((DC1>1 AND DC2>1), "true", "false") | fields - DC1 DC2
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Will there be any common key between data in two sources for comparison?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...