topic Re: create a table by comparing data from 2 different indexes in Splunk Search

create a table by comparing data from 2 different indexes

arjun_hcl — Wed, 29 Mar 2017 08:23:13 GMT

Hi,
I am trying to create a table by comparing data from 2 different indexes & compare certain search terms from one index with matching events from second index

for e.g
index1 may contain a field word and terms error, down, fatal
index2 may contain a field ticket and terms tkt1, tkt2, tkt3

idea is to write duplicate values of tickets against each matiching terms from index1

can someone help plz?

Re: create a table by comparing data from 2 different indexes

earlhelms — Wed, 29 Mar 2017 13:04:15 GMT

I'm not sure if I understand the question but this seems to call for a join. Reference: https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Join

Re: create a table by comparing data from 2 different indexes

niketn — Wed, 29 Mar 2017 13:13:13 GMT

@arjun_hcl... you would need to provide one key piece of information. Do you have any correlation field between the two indexes?

Consider index and sourcetype in Splunk to be Database and tables. For correlating them we would need to establish a foreign key which is present in both.

If possible please mock up your sample events from both indexes and post them here so that we can help you with the query you need. Do let us know the sourcetype for both indexes also.