Splunk Search

How do you combine data from two source types based on common values?

dminev1
Explorer

Hi there,

I have a question regarding source types. I have 2 source types "A" and "B". "A" has a field called "aaa" and "B" has field call "bbb". These two fields share the same value ( example: aaa=123, bbb=123) but the field name is different. I want to combine the two source types based on the fields with the same value(the value will change dynamically so I can't hardcode it) and extract data from both source types.

Is it possible and if it is, how would I approach this?

I tried something like this:

index=???  host=??? (sourcetype=A OR sourcetype=B) 
| rename aaa as bbb
| rex field=_raw "ClientId=(?\d+)"
| stats values(cID) as ID by bbb
| eval Duration = round(Duration,3)
| tab
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try something like this

index=???  host=??? (sourcetype=A OR sourcetype=B) 
 | eval commonfield=coalesce(aaa,bbb)
 | rex field=_raw "ClientId=(?<cID>\d+)"
 | stats values(cID) as ID values(Duration) as Duration by commonfield
 | eval Duration = round(Duration,3)

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try something like this

index=???  host=??? (sourcetype=A OR sourcetype=B) 
 | eval commonfield=coalesce(aaa,bbb)
 | rex field=_raw "ClientId=(?<cID>\d+)"
 | stats values(cID) as ID values(Duration) as Duration by commonfield
 | eval Duration = round(Duration,3)
0 Karma

dminev1
Explorer

It worked. Thank you for the quick response.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...