topic How do i search two seperate indexes and then output values from fields returned from each index? in Splunk Search

How do i search two seperate indexes and then output values from fields returned from each index?

ezmo1982 — Wed, 21 Apr 2021 16:07:37 GMT

Hi,

I am trying to search across two seperate indexes and then display fields returned from both indexes on a single line of my output.

Both indexes have a common field named "user" and I am search both indexes using this field.

The first part is "index=mcafee_wg user= supplied value" I want to search this index for a given value for "user" field and to display the value of a field named "url" in my output. "url" is a field in this index.

I also want to search a different index with "index=cisco_fmc user= supplied value" As above, I want to search this index for a given value for "user" field. From this index I want to display the value of a field named "detection" which is a field in this index.

So basically i want to combine these three fields together and output them on the same line, such as:

user url detection

value value value

Thanks!

Re: How do i search two seperate indexes and then output values from fields returned from each index?

ITWhisperer — Wed, 21 Apr 2021 16:14:42 GMT

index=mcafee_wg OR index=cisco_fmc user="supplied value" | stats values(url) as url values(detection) as detection by user

Re: How do i search two seperate indexes and then output values from fields returned from each index?

aasabatini — Wed, 21 Apr 2021 16:17:30 GMT

Hi @ezmo1982

but the user field needs to have the same values across the two indexes?

Re: How do i search two seperate indexes and then output values from fields returned from each index?

ezmo1982 — Wed, 21 Apr 2021 16:19:46 GMT

Yes, the value of the user field needs to be the same across both indexes.

Re: How do i search two seperate indexes and then output values from fields returned from each index?

aasabatini — Wed, 21 Apr 2021 16:49:15 GMT

you can try

(index=mcafee_wg user= supplied value") | join user[search index=cisco_fmc user= supplied value"] | table user url detection

be careful because splunk join comand works fine with a small set of data.

Re: How do i search two seperate indexes and then output values from fields returned from each index?

ezmo1982 — Wed, 21 Apr 2021 18:28:38 GMT

One thing I forgot to mention is that both indexes contain a field named "url". I am looking to output the "url" field from just the mcafee_wg index and not the cisco_fmc index.

Re: How do i search two seperate indexes and then output values from fields returned from each index?

ITWhisperer — Wed, 21 Apr 2021 21:00:35 GMT

index=mcafee_wg OR index=cisco_fmc user="supplied value" | eval url=if(index="mcafee_wg", url, null) | stats values(url) as url values(detection) as detection by user