Hi,
I have a correlation ID in one index
( index="AAA" | rex "XXXXXX\]\[(?.*?)\]" )
which I want to match with the correlation ID of other index ,
( index="BBB" | rex "CCCCCCC\]\[(?.*?)\]" )
Once matched I want to get the total count of how many correlation ID mathces between these two Indexes.
Please help me to get the results.
Hi abhayneilam,
based on the provided information, which is by the way very little, try something like this:
index="AAA" OR index="BBB"
| rex "XXXXXX\]\[(?<myID>.*?)\]"
| rex "CCCCCCC\]\[(?<myID>.*?)\]"
| streamstats window=2 last(myID) AS last_myID
| where myID=last_myID
| stats count by myID
This should give you an idea or take a closer look at this answer
http://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-joi...
hope this helps ...
cheers, MuS
Hi abhayneilam,
based on the provided information, which is by the way very little, try something like this:
index="AAA" OR index="BBB"
| rex "XXXXXX\]\[(?<myID>.*?)\]"
| rex "CCCCCCC\]\[(?<myID>.*?)\]"
| streamstats window=2 last(myID) AS last_myID
| where myID=last_myID
| stats count by myID
This should give you an idea or take a closer look at this answer
http://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-joi...
hope this helps ...
cheers, MuS
Thanks a lot !! 🙂
so for both the Indexes , do we need to keep the same filed name as "Correlation_ID"
index="AAA" | rex "XXXXXX][(?.?)]" | append [search index="BBB" | "CCCCCCC][(?.?)]" ] | stats count by correlaion_ID
tried this ?