topic Multiple source types in one search in Splunk Search

Multiple source types in one search

sandeep_thosar — Mon, 01 Apr 2013 10:17:44 GMT

Hi Team,

I have following scenario

source type :A contains Account Number
Source type :B Contains Account ID & Date

Want to write search to join this two source types and at the same time want to find Account Number of source type A in Account ID of source type B

Please help.

thanks in advance.

Re: Multiple source types in one search

smolcj — Mon, 01 Apr 2013 10:37:01 GMT

index=yourindex sourcetype=A | stats values(accountnumber) as accountid |join accountid [search index=yourindex sourcetype=B|table accountid date ]

did u try this?

Re: Multiple source types in one search

sandeep_thosar — Mon, 01 Apr 2013 11:14:21 GMT

Hi,

Thanks for help I am already tryed this but it's not fulfilled my requirements and i want to search Acccount Number from Source type A and on the basis of that want some values and Account ID from source B.

Please help as i am new to splunk.

Thanks in advance

Re: Multiple source types in one search

smolcj — Mon, 01 Apr 2013 12:31:44 GMT

sandeep, would u mind providing some more details?
like what was the output of this query and how your requirement differ from its output?
As I am not an expert in splunk, it may help me.
Thank u

Re: Multiple source types in one search

sandeep_thosar — Tue, 02 Apr 2013 06:34:16 GMT

My scenario is i have one Index which conatins two source files for ex. Source type="A" and Source Type="B". Both files contains Account ID which will be extracted using rex command. Now i want to search if account ID from Source type "A" is present in Source Type "B" then i want to extract customer ID from Source Type "B".

Re: Multiple source types in one search

lbogle — Sat, 19 Jul 2014 01:24:57 GMT

I have a similar search I am trying to work out except with machine hostnames. Single index w/ 5 different sources and am trying to build a report showing if a particular hostname shows up in each of the sources or perhaps highlight which source it's missing from.

Re: Multiple source types in one search

strive — Sat, 19 Jul 2014 04:28:38 GMT

You can achieve this using subsearches.
Note: dont forget to read the performance of subsearches in splunk documentation.

The below two links will help you

http://answers.splunk.com/answers/78899/problem-searching-for-matching-fields-within-multiple-source-types
http://docs.splunk.com/Documentation/Splunk/6.1.2/Search/Aboutsubsearches

Re: Multiple source types in one search

strive — Sat, 19 Jul 2014 04:30:58 GMT

You can achieve this using subsearches.
Note: dont forget to read the performance of subsearches in splunk documentation.

The below two links will help you

http://answers.splunk.com/answers/78899/problem-searching-for-matching-fields-within-multiple-source-types
http://docs.splunk.com/Documentation/Splunk/6.1.2/Search/Aboutsubsearches