topic Re: Correlating two indexes data in Splunk Search

Correlating two indexes data

abhayneilam — Fri, 24 Oct 2014 09:15:40 GMT

Hi,

I have a correlation ID in one index

( index="AAA" | rex "XXXXXX\]\[(?.*?)\]" )

which I want to match with the correlation ID of other index ,

( index="BBB" | rex "CCCCCCC\]\[(?.*?)\]" )

Once matched I want to get the total count of how many correlation ID mathces between these two Indexes.

Please help me to get the results.

Re: Correlating two indexes data

splunker12er — Fri, 24 Oct 2014 09:47:58 GMT

index="AAA" | rex "XXXXXX][(?.?)]" | append [search index="BBB" | "CCCCCCC][(?.?)]" ] | stats count by correlaion_ID

tried this ?

Re: Correlating two indexes data

abhayneilam — Fri, 24 Oct 2014 09:53:39 GMT

so for both the Indexes , do we need to keep the same filed name as "Correlation_ID"

Re: Correlating two indexes data

MuS — Fri, 24 Oct 2014 09:57:28 GMT

Hi abhayneilam,

based on the provided information, which is by the way very little, try something like this:

index="AAA" OR index="BBB"  
| rex "XXXXXX\]\[(?<myID>.*?)\]" 
| rex "CCCCCCC\]\[(?<myID>.*?)\]" 
| streamstats window=2 last(myID) AS last_myID 
| where myID=last_myID 
| stats count by myID

This should give you an idea or take a closer look at this answer
http://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-join-append-or-use-of-subsearches.html

hope this helps ...

cheers, MuS

Re: Correlating two indexes data

abhayneilam — Fri, 24 Oct 2014 10:26:30 GMT

Thanks a lot !! 🙂