Splunk Search

Can you help me find matching fields from 2 out of 3 sources?

Task1906
Explorer

Hello, I hope someone can help.

I am attempting to do a subsearch that I am having difficulty with and hope someone here can assist.

I would like any fields in SourceB or SourceC that match SourceA, to be returned

I'd previously had the following syntax:
SourceA | table field1 | search [ | search SourceB table field1 ] | search [ |search SourceC field1 | table src]

but now, I need it to be interpreded more like this:
SourceA field1 (SourceB field1 or SourceC field1)

Tags (2)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@Task1906

If you want to filter events from SourceA on the basis of field1 value from SourceB and SourceC then try this.

SourceA [ search SourceB | dedup field1 | fields field1 ] OR [ search SourceC | dedup field1 | fields field1] | join field1 [ search SourceC | dedup field1 | fields field1 src ]

Thanks

View solution in original post

Task1906
Explorer

kamlesh_vaghela, thanks for the input, thanks to you I have it working. But SourceA is not needed where it is. #2 SourceC is listed twice, and the 2nd time should be SourceA if it is removed from the beginning.
The working command looks like this:
[ search SourceB | dedup field1
| fields field1]
OR
[ search SourceB | dedup field1 | fields field1]
| join field1
[ search SourceA | dedup field1 | fields field1]
| table field1 | dedup field1

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@Task1906

If you want to filter events from SourceA on the basis of field1 value from SourceB and SourceC then try this.

SourceA [ search SourceB | dedup field1 | fields field1 ] OR [ search SourceC | dedup field1 | fields field1] | join field1 [ search SourceC | dedup field1 | fields field1 src ]

Thanks

Vijeta
Influencer

you can use an inner join between source B/C and source A on field that needs to be matched.

0 Karma
Get Updates on the Splunk Community!

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Combine Multiline Logs into a Single Event with SOCK: a Step-by-Step Guide for ...

Combine multiline logs into a single event with SOCK - a step-by-step guide for newbies Olga Malita The ...