topic Re: Extract data from 2 different logs in Splunk Search

Extract data from 2 different logs

chimuru84 — Tue, 30 Apr 2024 09:34:58 GMT

Hello community!

I want to extract data from 2 different logs like bellow:

Log 1: 2024-04-28 06:38:51 INFO Start auth for accountId=1, ip=192.168.1.1

Log 2: 2024-04-28 06:38:27 INFO Collect response for accountId=1, was: response=FINISH

For example for accountId=1 I have 10 logs with "Start auth", I mean 10 attempts of start auth.

In second log, for the same accountId I have 1 or more logs with FINISH.

I want to make a table like

accountId Start auth FINISH

1 10 1

Could you helm me with this?

Thank you.

Re: Extract data from 2 different logs

ITWhisperer — Tue, 30 Apr 2024 10:08:43 GMT

Have you already extracted accountId and response? If response does not have any value (null) does the event come from log1? If so, you could try something like this

| eval state=coalesce(response, "Start auth") | chart count by accountId state

Re: Extract data from 2 different logs

chimuru84 — Tue, 30 Apr 2024 10:49:25 GMT

It works, thank you very much. One more thing, time filter isn't work, I mean if I set for 24H, search return logs for all time

Re: Extract data from 2 different logs

ITWhisperer — Tue, 30 Apr 2024 10:51:54 GMT

This is a different question. Please start a new question with as much detail as possible.