Splunk Search

How can I search across two sourcetypes for matching fields and output a table with matching results?

vkrishnachand
New Member

Hi

I have one index with two sourcetypes: S1 and S2. In sourcetype S1 I have fields A, B, C and in sourcetype S2 I have fields D, E, F.

The values in B field will sometimes be equal to values in E field, where if they are equal my final output should be in form of table with fields A,B,C,D,E,F.

Please help on the same.

0 Karma

vkrishnachand
New Member

Hi

thanks for this. I should display the result in a table something like a table with all the fields combined to gether something like table A B C D E F. how to do this.

0 Karma

jplumsdaine22
Influencer

If B & E are unique identifiers that are the same, you could do something like this:

index=A (sourcetype=S1 OR sourcetype=S2) 
| eval G=coalesce(B,E) 
| stats values(A) as A values(C) as C values(D) as D values(F) as F by G

vkrishnachand
New Member

Hi

thanks for this. I should display the result in a table something like a table with all the fields combined to gether something like table A B C D E F. how to do this.

0 Karma

jplumsdaine22
Influencer

That search should do it. You can rearrange the fields like this if you want:

 | fields A G C D F

(don't forget we made G the value of B or E)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...