https://community.splunk.com/t5/Splunk-Search/Find-a-common-field-with-introspection-and-internal-or-auit/m-p/681370#M232831 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/265821">@sairajkiran</a>&nbsp;<BR /><BR />Try checking the values from the job inspector for your event/search. Not sure if it will fulfil your needs.<BR /><BR />The field you can use is search_id -- in _introspection and _audit indexes<BR />For _internal, you'll need to extract this value from job which looks something like this&nbsp;<SPAN class="">search/search/jobs/1710936732.74</SPAN><SPAN>/</SPAN><SPAN class="">control<BR />so the search_id field value is&nbsp;1710936732.74&nbsp;</SPAN></P><P><SPAN class="">If the reply helps, a Karma vote would be appreciated.</SPAN></P> Wed, 20 Mar 2024 12:21:46 GMT Gr0und_Z3r0 2024-03-20T12:21:46Z https://community.splunk.com/t5/Splunk-Search/Find-a-common-field-with-introspection-and-internal-or-auit/m-p/680378#M232545 <P>Hi All,</P><P><SPAN><SPAN class="">our SVC calculation is in _introspection and and our search name is in _internal and _audit. We need a common filed to map those together so we can tie an SVC (and dollar amount) to a particular search. We tried doing it using the SID but that is not matching.&nbsp;</SPAN></SPAN></P><P>Can someone help me out here based on your experiences.</P> Tue, 12 Mar 2024 09:40:25 GMT https://community.splunk.com/t5/Splunk-Search/Find-a-common-field-with-introspection-and-internal-or-auit/m-p/680378#M232545 sairajkiran 2024-03-12T09:40:25Z https://community.splunk.com/t5/Splunk-Search/Find-a-common-field-with-introspection-and-internal-or-auit/m-p/681370#M232831 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/265821">@sairajkiran</a>&nbsp;<BR /><BR />Try checking the values from the job inspector for your event/search. Not sure if it will fulfil your needs.<BR /><BR />The field you can use is search_id -- in _introspection and _audit indexes<BR />For _internal, you'll need to extract this value from job which looks something like this&nbsp;<SPAN class="">search/search/jobs/1710936732.74</SPAN><SPAN>/</SPAN><SPAN class="">control<BR />so the search_id field value is&nbsp;1710936732.74&nbsp;</SPAN></P><P><SPAN class="">If the reply helps, a Karma vote would be appreciated.</SPAN></P> Wed, 20 Mar 2024 12:21:46 GMT https://community.splunk.com/t5/Splunk-Search/Find-a-common-field-with-introspection-and-internal-or-auit/m-p/681370#M232831 Gr0und_Z3r0 2024-03-20T12:21:46Z