Splunk Search

Correlating field values and finding where they match

sasisudas
New Member

Hello guys,

So I have struggled writing search pipeline for this senario:

I have comparing unique id(numerical value) in 3 different fields (id_1,id_2,id_3). The data looks something like:
id_1 | id_2 | id_3
1 3 4
2 4 5
3 5 6
4 6 5
4 5 3

I want to find out where all three columns have a matching value.
For example, here 4 would be a unique value that appears in all three fields.

I have run different seaches:
...|table id_1.id_2,id_3|where id_1==id_2==id_3
...|eval matchname=id_2|where id_1==matchname <-tried with 2 fields first, no result
...|table id_1, id_2|eval matchname=if(id_1==id_2,"y","n")
...|stats values(id_1) by id_2,id_3

I am new to Splunk so please excuse my lack of knowledge on the different commands. But i feel like I might be missed a big concept in Splunk Search Language.

Advance thanks for any help on this.

-New Splunk Enthusiast

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

This should do, starting from your initial table:

... | table id_1 id_2 id_3 | eval foo = 42 | untable foo name value | stats dc(name) as dc by value | where dc=3

That will distinct-count the field names per value, and only keep those values that occur in all three field names.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...