topic Re: How to merge two Splunk Queries ? in Splunk Search

How to merge two Splunk queries ?

nilbak88 — Thu, 21 Apr 2022 14:24:30 GMT

Hi All,

I need help with Splunk Query for below scenario:

Query 1:
index =abc | table src, dest_name, severity, action

If it finds dest_name for any high and critical severity, it will look for computerdnsname in index xyz and there if it matches, it will display the result

Query 2:

index=xyz

Re: How to merge two Splunk Queries ?

richgalloway — Fri, 15 Apr 2022 13:21:56 GMT

How to merge the queries depends on what results you want displayed. Please tell us more about that.

Re: How to merge two Splunk Queries ?

gcusello — Fri, 15 Apr 2022 15:40:53 GMT

Hi @nilbak88,

as @richgalloway said it's difficoult to help you with these few informations, so anyway I try to suppose your need:

Query 1: (index =abc (severity=high OR severity=critical)) OR index=xyz | eval dest_name=coalesce(dest_name,computerdnsname) | stats values(src) AS src values(severity) AS severity values(action) AS action dc(index) AS dc_index BY dest_name | where dc_index=2 | table dest_name src severity action

Ciao.

Giuseppe

Re: How to merge two Splunk Queries ?

gcusello — Thu, 21 Apr 2022 12:04:18 GMT

Hi @nilbak88,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Re: How to merge two Splunk Queries ?

nilbak88 — Thu, 21 Apr 2022 12:05:23 GMT

thanks @gcusello .
That's what i was looking for.
However, i will get back to you on this again if needed more help