Hello Everyone.
I wonder if anyone could help me with a report I'm trying to make.
Below is my sample logs format.
log1 example.
ipfield sessionfield - - timefield urlfield methodfield
log2 example
datefied midfield sessionfield2 sessionfield3 userfield functionfield ipfield2 rolefield.
what I want to do is search log2 if the sessionfield in log1 exists, then print out a table that has
userfield from log2, ipfield from log1orlog2, all sessionfield from log1 and log2, userfield from log2, urlfield and mehtodfield and the counts of methodfield.
I have something like this
(index=1 log2) OR (index=1 log1)| eval sessionfield=coalesce(sessionfield,sessionfield2,sessionfield3) | stats values(sessionfield) values(ipfield2) by sessiontuser
I got the sessionfield(s) to print but it did not print the sessionfield in log1.
I could not figure out how to print the other fields that I needed
I don't have much experience in Splunk search so any guidance or help would be excellent.
thank you.
... View more
