topic Re: Dealing with multiple fields from different sourcetype that have the same name in Splunk Search

Dealing with multiple fields from different sourcetype that have the same name

Kavey — Mon, 25 Apr 2016 08:41:15 GMT

Hi,

here is my problem : I have a sourcetype A with a field X and Z and a sourcetype B with a field Y and Z. The thing I would like to do is using the field X and Z of sourcetype A and field Y of sourcetype B.

What is the simplest way to achieve this?

Thank you in advance for helping me 🙂

Re: Dealing with multiple fields from different sourcetype that have the same name

ktugwell_splunk — Mon, 25 Apr 2016 09:09:02 GMT

Hey Kavey,

Take a look at the append command
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Append

You could do a subsearch to retrieve Z from sourcetype B.

Re: Dealing with multiple fields from different sourcetype that have the same name

Kavey — Mon, 25 Apr 2016 09:27:40 GMT

Hi, thanks for replying!

I already thought about it but I would like not to use a subsearch since it will affect the performance... Moreover the number of events that could be returned might be big

Re: Dealing with multiple fields from different sourcetype that have the same name

ktugwell_splunk — Mon, 25 Apr 2016 09:33:53 GMT

How about using eval to generate a new field identifying which sourcetype the data comes from?

... | eval Z1=IF(sourcetype=A, Z, NULL) | eval Z2=IF(sourcetype=B, Z, NULL)

Will that work for you?

Re: Dealing with multiple fields from different sourcetype that have the same name

ctaf — Mon, 25 Apr 2016 09:34:58 GMT

How about creating a field alias of the field Y of the sourcetype B?
Then it would have a different name and you will be able to do what you want.

Re: Dealing with multiple fields from different sourcetype that have the same name

HeinzWaescher — Mon, 25 Apr 2016 09:37:05 GMT

You could use a field aliases for sourcetype B and rename fields, so that they don't have same names across your sourcetypes.

settings -> fields -> field aliases

Re: Dealing with multiple fields from different sourcetype that have the same name

Kavey — Mon, 25 Apr 2016 09:50:44 GMT

Thank you I didn't know about that feature it is indeed what I was looking for. However is there any other way to do this simply within the query ?

Re: Dealing with multiple fields from different sourcetype that have the same name

HeinzWaescher — Mon, 25 Apr 2016 09:59:09 GMT

You could also use eval & if to target specific sourcetypes

Like here in a stats command

... | stats sum(eval(if(sourcetype="A", Z, null()))) AS result

This sums up all values for Z if sourcetype="A"

Re: Dealing with multiple fields from different sourcetype that have the same name

javiergn — Mon, 25 Apr 2016 10:54:24 GMT

Another way to easily differentiate field names dynamically is by using the following syntax:

| eval yourfieldname-{sourcetype} = yourfieldname

For instance, if you have a field Z in both sourcetype A and sourcetype B, you could do the following:

| eval fieldZ-{sourcetype} = fieldZ

And Splunk will dynamically create the following two fields for you based on the value of your sourcetype:

fieldZ-sourcetypeA
fieldZ-sourcetypeB

If there were more sourcetypes added later on this would still work.
Hope that helps.

Re: Dealing with multiple fields from different sourcetype that have the same name

Kavey — Mon, 25 Apr 2016 11:13:15 GMT

Thanks, that method helped too! 🙂

Re: Dealing with multiple fields from different sourcetype that have the same name

Kavey — Mon, 25 Apr 2016 13:00:36 GMT

I didn't choose that method but it is a way to achieve what I want, thank you