Splunk Search

Combining 2 different search results based on fields

selim
Path Finder

Hello,

I have 2 different searches for 2 different sourcetypes with field extractions. I'm doing the field extractions for search1 for xml data.

search1:

sourcetype=xmlapp | xmlkv

search2:

sourcetype=app2

I'd like to combine searches in such a way that when field2 from search2 does NOT match any existing field1 from search1, I need to create an alert. Any help is greatly appreciated.

Tags (2)
0 Karma
1 Solution

Ayn
Legend

I believe something like this should work:

sourcetype=xmlapp | xmlkv | search NOT [search sourcetype=app2 | rename field2 as field1 | fields field1]

View solution in original post

Ayn
Legend

I believe something like this should work:

sourcetype=xmlapp | xmlkv | search NOT [search sourcetype=app2 | rename field2 as field1 | fields field1]

Ayn
Legend

Hi @pramit46, I renamed it because the requirement was that values from field2 in the subsearch would be matched to values of field1 in the main search.

0 Karma

pramit46
Contributor

@Ayn, Can you please explain why did you rename the field2?
I also have the same question as that in Selim's comment. Any help would be appreciated.

0 Karma

selim
Path Finder

Thank you. That works for finding the events. So, how do display more fields (e.g. field1, field2, field3 from search#1 and field4, field5 from search#2) to the results so that I can display them in a table (or chart)? I tried fields command but was not successful.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...