topic Re: Use result of set intersect for another command in Splunk Search

Use result of set intersect for another command

catalinberbece — Fri, 13 Jul 2018 13:34:47 GMT

Hello,

I am trying to use the result of an intersect to further search in one of the indexes.
| set intersect
[search index=A something...
|table IP]
[search index=B something...
| table IP]
///at this point I have a table of common IPs between the two indexes. Now I want to add to that table another field which is only present in the index=B, so the final result will look like:

IP                      Description
x.x.x.x                  something1
y.y.y.y                  something2

Both IP and Description are extracted fields.

Re: Use result of set intersect for another command

somesoni2 — Fri, 13 Jul 2018 13:57:33 GMT

Try this

index=B [search index=A something...
|table IP]
|  table IP Description

Re: Use result of set intersect for another command

renjith_nair — Fri, 13 Jul 2018 14:01:36 GMT

Hi @catalinberbece,

Try this,
EDITED as per the new requirement.

(index=A OR index=B) |rename IP_ADDRESS as clientIP |stats dc(index) as dcIndex, values(Description) as Description by clientIP|where dcIndex >1

Re: Use result of set intersect for another command

catalinberbece — Fri, 13 Jul 2018 14:28:04 GMT

I've just tried both solutions but neither works. I want to mention that for one index the IP is named "clientIP" while for the other index is named "IP_ADDRESS". Also, the description field is present only on the index where IP is named "clientIP".

Re: Use result of set intersect for another command

renjith_nair — Sat, 14 Jul 2018 04:00:33 GMT

Updated the answer, please try and lets know