topic How to find items from one index across other index's. in Splunk Search

How to find items from one index across other index's.

SMM10 — Fri, 19 Nov 2021 22:03:57 GMT

We have specific ID's that track how request process through the system. What I want to do search for all these ID's in one index and then join all other index's to see how these funnel down. So essentially track how a request tracks through our system, and then get all the service requests associated. I was thinking something like:

index=foo |fields service, ID | join ID [index=*] | stats service

Re: How to find items from one index across other index's.

PickleRick — Fri, 19 Nov 2021 22:56:57 GMT

If all your events in question had the ID field you could do something like (rough idea)

index=* ID=* | stats values(_raw) by ID

But that would mean doing stats across all your indexes which is not very effective to say the least.

But your join would be even worse 😉

Re: How to find items from one index across other index's.

bowesmana — Sun, 21 Nov 2021 21:32:21 GMT

At the most basic, if you go for join, then your existing SPL should look something like this

index=foo | stats count by service ID [ | join ID [index!=foo] | stats values(service) by ID ]

but join is never a great option - it is slow and has limitations in the number of results that can be handled by the subsearch - and the solution is not to increase the limit.

As @PickleRick says, it is better to run stats across the data set you want to search and then perform stats and test operations on the results.

The question is: What do you want to do having found the correlated services - is there any other data you want to use following the initial search, if so that will dictate how your search will look.