Splunk Search

join and compare the values in 2 different field which values are same from different

svemurilv
Path Finder

in my search contcxtid and sourceSession has the same vales but indexing in to different places how could i compare the 2 field values and want to display the command filed values

index=mapps sourcetype=iis  host=* earliest=-1h@m|dedup ContextId |table ContextId |join type=inner ContextId [search index=gateways  source=http:ClientLoggingProd message.application="samrts" earliest=-1h@m | dedup "message.sourceSession" |rename message.sourceSession as sourceSession] |eval nodiff=if(match(sourceSession,ContextId),"ContextId",NULL) 
Tags (1)
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Assumptions: you want the last record from each message.sourceSession from index=gateways, that has a ContextId in index mapps for the same time frame.

It is important to note that you aren't using any information from the mapps index other than the presence of a record, so getting the latest is not needed - if any record exists in index mapps for a ContextId, then you want the corresponding latest record from the other index.

Try this...

earliest=-1h@m
(index=mapps sourcetype=iis  host=* ) OR (index=gateways source=http:ClientLoggingProd message.application="samrts" )
| rename message.sourceSession as sourceSession
| fields index ContextId sourceSession (and whatever else you need) 
| eventstats max(eval(case(index="mapps",1))) as mappfound by ContextId
| where mappfound=1 and index="gateways"
| dedup sourceSession
0 Karma

somesoni2
SplunkTrust
SplunkTrust

I would do like this (gives list of common ContextId values between two data sources of yours)

(index=mapps sourcetype=iis  host=*) OR (index=gateways  source=http:ClientLoggingProd message.application="samrts") earliest=-1h@m | eval ContextId=coalesce('message.sourceSession',ContextId) | stats count by ContextId | table ContextId
0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...