https://community.splunk.com/t5/Splunk-Search/How-to-find-same-values-in-different-sources/m-p/605327#M210495 <P>OK Thanks - that would have been useful to know up front though!</P> Tue, 12 Jul 2022 18:19:18 GMT ITWhisperer 2022-07-12T18:19:18Z https://community.splunk.com/t5/Splunk-Search/How-to-find-same-values-in-different-sources/m-p/604866#M210360 <P>Our login page is developed by team1 and the main home page (After login) is developed by team2. The event logs from each use completely different structures. I strongly suspect unique system identifiers in the login logs may be carried into the home page logs, but I don't know which fields (out of 20-50 fields in each log) may contain similar values.&nbsp;</P> <P>Is there a method to find fields that have the same value in both sources if I don't know which fields to match on?&nbsp;</P> <P>(index=A sourcetype="login" colA="apple", colB="ABC123" , colC="purple")<BR />(index=B sourcetype="home" field1="yellow", field2="orange", ..., field20="ABC123", field21="Monkey")</P> <P>How can I search both sources to identify ( login.colB == home.field20) if I don't know in advance those fields match? I may not find ANY common values...</P> Tue, 12 Jul 2022 18:46:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-same-values-in-different-sources/m-p/604866#M210360 Momgineer 2022-07-12T18:46:47Z https://community.splunk.com/t5/Splunk-Search/How-to-find-same-values-in-different-sources/m-p/604879#M210364 <P>Do the unique system identifiers have a known and consistent format e.g. AAANNN as in your example? If so, you could try extracting a new field with rex based on this pattern</P><LI-CODE lang="markup">| rex max_match=0 "\"(?&lt;uid&gt;[a-zA-Z]{3}\d{3})\""</LI-CODE> Fri, 08 Jul 2022 05:26:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-same-values-in-different-sources/m-p/604879#M210364 ITWhisperer 2022-07-08T05:26:06Z https://community.splunk.com/t5/Splunk-Search/How-to-find-same-values-in-different-sources/m-p/604889#M210367 <P>If you just want to find fields with the same value, you can use something like that:</P><LI-CODE lang="markup">(index="A" sourcetype="login") OR (index="B" sourcetype="home") | eval kv = "---" | foreach * [| eval kv = mvappend(kv, index + ":" + sourcetype + ":&lt;&lt;FIELD&gt;&gt;" + "|" + '&lt;&lt;FIELD&gt;&gt;')] | eval kv=mvfilter(!match(kv, "---")) | fields kv | mvexpand kv | makemv kv delim="|" | eval field=mvindex(kv,0) | eval value=mvindex(kv,1) | stats values(field) as fields by value | where mvcount(fields) &gt; 1</LI-CODE><P>This should give you a table of values and a fields list this value appears in.</P><P>For example, the below query:</P><LI-CODE lang="markup">| makeresults 1 | eval index="A", sourcetype="login", colA="apple", colB="ABC123" , colC="purple" | append [| makeresults 1 | eval index="B", sourcetype="home", field1="yellow", field2="orange", field3="lemon", field4="tomato", field5="potato", field20="ABC123", field21="Monkey"] | eval kv = "---" | foreach * [| eval kv = mvappend(kv, index + ":" + sourcetype + ":&lt;&lt;FIELD&gt;&gt;" + "|" + '&lt;&lt;FIELD&gt;&gt;')] | eval kv=mvfilter(!match(kv, "---")) | fields kv | mvexpand kv | makemv kv delim="|" | eval field=mvindex(kv,0) | eval value=mvindex(kv,1) | stats values(field) as fields by value | where mvcount(fields) &gt; 1</LI-CODE><P>produces the following results:</P><TABLE border="1" width="100%"><TBODY><TR><TD width="50%">value</TD><TD width="50%">fields</TD></TR><TR><TD width="50%">ABC123</TD><TD width="50%"><P>A:login:colB<BR />B:home:field20</P></TD></TR></TBODY></TABLE><P>which means that value "ABC123" appears in index A sourcetype login colB and index B sourcetype home field20</P> Fri, 08 Jul 2022 07:16:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-same-values-in-different-sources/m-p/604889#M210367 JacekF 2022-07-08T07:16:28Z https://community.splunk.com/t5/Splunk-Search/How-to-find-same-values-in-different-sources/m-p/605325#M210493 <LI-SPOILER>This is great! Exactly what I was hoping for. Thank you!</LI-SPOILER> Tue, 12 Jul 2022 18:15:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-same-values-in-different-sources/m-p/605325#M210493 Momgineer 2022-07-12T18:15:39Z https://community.splunk.com/t5/Splunk-Search/How-to-find-same-values-in-different-sources/m-p/605326#M210494 <P>Thank you for the input. Unfortunately, they are just random system-generated UIDs:&nbsp;<BR /><BR /><SPAN>1d1d33c5-0e5a-4cbe-afc4-c8c514ff62f4</SPAN><BR /><SPAN>d9be033a-703c-4f6b-a5de-c514f80e1a47</SPAN></P> Tue, 12 Jul 2022 18:17:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-same-values-in-different-sources/m-p/605326#M210494 Momgineer 2022-07-12T18:17:35Z https://community.splunk.com/t5/Splunk-Search/How-to-find-same-values-in-different-sources/m-p/605327#M210495 <P>OK Thanks - that would have been useful to know up front though!</P> Tue, 12 Jul 2022 18:19:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-same-values-in-different-sources/m-p/605327#M210495 ITWhisperer 2022-07-12T18:19:18Z