topic Re: Find common values starting with in Splunk Search

Find common values starting with

Mary666 — Mon, 01 Nov 2021 00:25:50 GMT

Hi There,

Any guidance on how to find common values starting with similar values from two different sources?

exp:

Source: 1 field:SerialId value: 123_abc

Source: 2 field: SerialId value: 123_abcde

so if the values start with the first common 6 letters and numbers-find those matching.

any advice on how to approach this?

Re: Find common values starting with

vhharanpositka — Mon, 01 Nov 2021 02:50:44 GMT

Hi @Mary666

As per my understanding, you can use the field name and the value with the starting common character with a wildcard.

Source: 1

field:SerialId value: 123*

Source: 2

field: SerialId value: 123*

This will fetch the common values from that fields.

Example Screenprint:

Thanks

Re: Find common values starting with

Mary666 — Mon, 01 Nov 2021 20:26:28 GMT

Thanks, but I should have been more detailed. The values can be numbers and letters and can be different in size. So basically I am trying to do this:

Index="123", team=green, ID=123Azz_mpr

Index="456" , team=blue, ID=123Cxx_1

Desired result:
ID=123

I have tried
| eval ShortMessage= substr(ID1,3) this does work, but it does not include the data for both indexes.

Re: Find common values starting with

vhharanpositka — Tue, 02 Nov 2021 05:11:29 GMT

Try this,

index="123" OR index="456" (team=green OR team=blue) ID=123*