https://community.splunk.com/t5/Splunk-Search/How-to-join-two-log-files-in-Splunk/m-p/49939#M11986 <P>Hi all,</P> <P>I have to two sourcetypes(NetSweep_log &amp; Radius_log), both of them have a common field called "FramedIP". How can i extract the rows which have this common field ??</P> <P>Please help.<BR /> Thanks!!</P> Mon, 28 Sep 2020 12:22:22 GMT alenseb 2020-09-28T12:22:22Z https://community.splunk.com/t5/Splunk-Search/How-to-join-two-log-files-in-Splunk/m-p/49939#M11986 <P>Hi all,</P> <P>I have to two sourcetypes(NetSweep_log &amp; Radius_log), both of them have a common field called "FramedIP". How can i extract the rows which have this common field ??</P> <P>Please help.<BR /> Thanks!!</P> Mon, 28 Sep 2020 12:22:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-join-two-log-files-in-Splunk/m-p/49939#M11986 alenseb 2020-09-28T12:22:22Z https://community.splunk.com/t5/Splunk-Search/How-to-join-two-log-files-in-Splunk/m-p/49940#M11987 <P>So basically you will need to (and sorry if there is some repetition to what you have done, question is a little unclear) is...</P> <P>Extract the fields for each sourcetype, with the easiest way being the <A href="http://docs.splunk.com/Documentation/Splunk/latest/User/InteractiveFieldExtractionExample">IFX</A> (Interactive Field eXtractor), alternatively using <A href="http://docs.splunk.com/Documentation/Splunk/4.3.3/Knowledge/Addfieldsatsearchtime#Add_fields_at_search_time_through_configuration_file_edits">conf files</A>.</P> <P>Search those sourcetypes and you should have that field available in your Field Discovery panel (on the left). e.g....</P> <PRE><CODE>(Soucetype=NetSweep_log OR sourcetype=Radius_log) | top FramedIP </CODE></PRE> <P>Shoule be simple enough.</P> <P>Hope this helps, if it doesn't please explain a little more</P> <P>MHibbin</P> Mon, 03 Sep 2012 12:55:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-join-two-log-files-in-Splunk/m-p/49940#M11987 MHibbin 2012-09-03T12:55:35Z https://community.splunk.com/t5/Splunk-Search/How-to-join-two-log-files-in-Splunk/m-p/49941#M11988 <P>I guess this shows all the FramedIP from both the sourcetype.<BR /> But what i really need is All the data available in NetSweep_Log for FramedIP present in Radius_log.</P> <P>I am new to Splunk. Sorry if its a stupid question.</P> <P>Thanks!!</P> Mon, 28 Sep 2020 12:22:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-join-two-log-files-in-Splunk/m-p/49941#M11988 alenseb 2020-09-28T12:22:24Z https://community.splunk.com/t5/Splunk-Search/How-to-join-two-log-files-in-Splunk/m-p/49942#M11989 <P>So you want to use the values from the FramedIP field from the NetSweep_Log and use it search in the Radius Logs?</P> <P>In that case you will need to use the subsearch feature, this will involve:</P> <OL> <LI>Define you base search to gather field values (e.g. <CODE>sourcetype=NetSweep_Log | top FramedIP</CODE>)</LI> <LI>Append this to your main search, where you look at the Radius_log (e.g. <CODE>sourcetype=Radius_log [search sourcetype=NetSweep_Log | top FramedIP | fields + FramedIP]</CODE>) </LI> </OL> <P>I'm assuming this is what you after. You should read docs here... <A href="http://docs.splunk.com/Documentation/Splunk/4.3.3/User/HowSubsearchesWork" target="_blank">http://docs.splunk.com/Documentation/Splunk/4.3.3/User/HowSubsearchesWork</A></P> Mon, 28 Sep 2020 12:22:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-join-two-log-files-in-Splunk/m-p/49942#M11989 MHibbin 2020-09-28T12:22:27Z https://community.splunk.com/t5/Splunk-Search/How-to-join-two-log-files-in-Splunk/m-p/49943#M11990 <P>If this answers your question please mark it as accepted (with the tick next to the answer), and if you are feeling generous you can also up-vote it. Thanks <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Mon, 03 Sep 2012 13:38:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-join-two-log-files-in-Splunk/m-p/49943#M11990 MHibbin 2012-09-03T13:38:25Z https://community.splunk.com/t5/Splunk-Search/How-to-join-two-log-files-in-Splunk/m-p/49944#M11991 <P>I tried this command, but it returns "0 matching events".<BR /> The logic seems to be correct though.<BR /> Is there any syntax we are missing?</P> Tue, 04 Sep 2012 06:42:12 GMT https://community.splunk.com/t5/Splunk-Search/How-to-join-two-log-files-in-Splunk/m-p/49944#M11991 alenseb 2012-09-04T06:42:12Z