topic same field name exists in two indexes but with different values in Splunk Search

same field name exists in two indexes but with different values

moayadalghamdi — Thu, 27 May 2021 09:21:35 GMT

Hola splunker.

i performed a search using two indexes, but these tow indexes have different fields that uses the same field name, for example:

EmailServer: has the filed name message_subject

EmailProxy: has the filed name message_subject

i want to search using the message_subject from the EmailServer

index=EmailServer OR index=EmailProxy NOT (src_ip=10.0.0.0/8 OR src_ip=192.168.0.0/16 OR src_ip=172.16.0.0/12 ) | table src_ip sender EmailServer.message_subject

Thanks ^_^^

Re: same field name exists in two indexes but with different values

ITWhisperer — Thu, 27 May 2021 09:26:56 GMT

index=EmailServer OR index=EmailProxy NOT (src_ip=10.0.0.0/8 OR src_ip=192.168.0.0/16 OR src_ip=172.16.0.0/12 ) | eval "EmailServer.message_subject"=if(index="EmailServer",message_subject,null) | table src_ip sender EmailServer.message_subject

Re: same field name exists in two indexes but with different values

moayadalghamdi — Thu, 27 May 2021 09:37:10 GMT

Thanks for the answer Whisperer ^_^

this is the result i got:

i forgot to tell you something, the src_ip field only exists at the EmailProxy, so the field sender is mutual,

so i want the stats to have:

EmailProxy.src_ip /// EmailServer.sender /// EmailServer.message_subject.

Thanks^_^

Re: same field name exists in two indexes but with different values

ITWhisperer — Thu, 27 May 2021 09:50:46 GMT

index=EmailServer OR index=EmailProxy NOT (src_ip=10.0.0.0/8 OR src_ip=192.168.0.0/16 OR src_ip=172.16.0.0/12 ) | eventstats values(src_ip) as "EmailProxy.src_ip" by sender | eval "EmailServer.message_subject"=if(index="EmailServer",message_subject,null) | table EmailProxy.src_ip sender EmailServer.message_subject

Re: same field name exists in two indexes but with different values

moayadalghamdi — Thu, 27 May 2021 09:57:20 GMT

w'ere getting close !

unfortunately the src_ip field is null:

also the are empty records/Almost empty records:

thanks so much for your time, i really appreciate it, please help with this one

^_^

Re: same field name exists in two indexes but with different values

ITWhisperer — Thu, 27 May 2021 10:10:49 GMT

Can you clarify that the proxy will have events for user and src_ip and the server will have events for the user and subject, i.e. the exact same value for user exists in both sets of events? If not, how are you trying to correlate events from the two indexes?