Splunk Search

merge search between 2 index

aalhabbash1
Path Finder

We need to merge results from two indexes,

I mean, I need any successfully login for users at the same time from two indexes, means I have the SAP logs and windows logs, I need any user access the SAP at 8 AM and at the same time this user access the windows logs. I need to show the count access and users from SAP index and need to show all sources, all destinations from windows index at the same time from two indexes:

for clarification you can see what I need show in the table:
users, count access from SAP index, count access from windows index, all sources from windows index, all destinations from windows index, and time.

Regarding the all sources from windows index, and all destinations from windows index, we need to view all sources and destinations which used from this users values(dest) values(src).

Note:
No need to view the source if owns it from user, we need the source if access from another user not from user which owns this device

no need to display in the table if user access from his device, If was user is aaaaa and he owns device (hqr-aaaaa), no need to display in the table if user=aaaaa and source=hqr-aaaaa?

Please support me in that.

BR;

0 Karma

cquinney
Communicator

Were you ever able to resolve this issue/question?

If not, did you try appending the windows index or SAP index in a sub-search then doing a stats command for the fields you need based on the user?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...