My scenario is thus:
The main search searches for a pattern in a sourcefile:
source="/apps.log" index=idx "abc" | xmlkv | Search TransactionStatus=Complete |table _time SerialNumber
It then looks up the SerialNo field in another search result, say:
search source="/apps.log" index=idx "edf" | xmlkv | search CoverageCd=Done |table SerialNo
If the SerialNumber in the main search is found the in the SerialNo in the subsearch, then I need to create a new Boolean field called Found and set it to True, for all those events that are found in the subsearch, the field is set to False.
I can easily offload the data to Python dataframes and achieve this but really need to do it within Splunk for online efficiency.
Could anyone help on this?
Thanks
... View more