How can I merge two splunk queries together?

Taibat02230232 — Wed, 30 Nov 2022 18:01:02 GMT

I have two Splunk queries 1 and 2 below, and both have one common email , i want the searched emails generated from the result which are email variable to be able to send an alert notification base on the search result generated email.

I need the common value to have the field with matching values in both queries which is the email , then be able to send an email alert notification

Query-1

index="aws-cloudtrail" eventName="AssumeRoleWithSAML" |fields * | spath "requestParameters.roleArn" |search "*super*admin*" | rex field=responseElements.subject "(?<Email>[a-zA-Z0-9]{1,8}@digitlogs.com$)" | search Email=* | table Email,"recipientAccountId" | dedup Email, "recipientAccountId"

Query-2

index="okta" displayMessage="Authenticate user with AD agent" | rename target{}.alternateId as email | eval my_ponies=mvindex(email, -3, -2) | eval Email=mvindex(email, 0) | eval email=mvindex(email, 1) | table Email email

Here are the two of them, please any input will help

Re: Merging two splunk queries together

gcusello — Wed, 30 Nov 2022 07:46:01 GMT

Hi @Taibat02230232,

if you're sure that one of the searches has less than 50,000 results, you can use append:

index="aws-cloudtrail" eventName="AssumeRoleWithSAML" | spath "requestParameters.roleArn" | search "*super*admin*" | rex field=responseElements.subject "(?<Email>[a-zA-Z0-9]{1,8}@digitlogs.com$)" | search Email=* | table Email,"recipientAccountId" | dedup Email, "recipientAccountId" | append search index="okta" displayMessage="Authenticate user with AD agent" | rename target{}.alternateId as email | eval my_ponies=mvindex(email, -3, -2) | eval Email=mvindex(email, 0) | eval email=mvindex(email, 1) | table Email email ] | stats values(recipientAccountId) AS recipientAccountId values(email) AS email BY Email

otherwise you have to use a more complex search.

Ciao.

Giuseppe

topic Re: Merging two splunk queries together in Getting Data In

How can I merge two splunk queries together?

Re: Merging two splunk queries together