topic Re: How to tie in 2 different event sources to display a field value from one source based on a value from the other sou in Splunk Search

How to tie in 2 different event sources to display a field value from one source based on a value from the other source.

mninansplunk — Wed, 13 Nov 2024 16:08:53 GMT

Hello,

Sorry, still trying to get the hang of Search queries. I am tasked with creating a table that displays a server name from one search, with a team name from another search that corresponds with the server name. In example,

1st Search

index="netscaler | table servername

Results in a table like:

servername1

servername2

2nd Search

index="main | table teamname

Results in a table like

teamname1

teamname2

I need to make 1 table that will display the corresponding teamname to the servername. Like If servername = servername2, display teamname2 in the same table row.

Does that make sense. 🙂 Let me know if any details are needed. Not sure how to do this one.

Thanks for any help,

Tom

Re: How to tie in 2 different event sources to display a field value from one source based on a value from the other sou

richgalloway — Wed, 13 Nov 2024 16:39:55 GMT

The two searches have no obvious relationship to each other. How is Splunk to know how to match a server name to a team name?

Re: How to tie in 2 different event sources to display a field value from one source based on a value from the other sou

mninansplunk — Wed, 13 Nov 2024 17:05:33 GMT

Hello,

Thanks for your help, I am hoping for a way in the search to say something like if name from first query = servername1 then name from second query = teamname1. But, have no idea how to achieve that.

Thanks,

Tom

Re: How to tie in 2 different event sources to display a field value from one source based on a value from the other sou

ITWhisperer — Wed, 13 Nov 2024 17:09:47 GMT

It might be helpful if you shared some sample (anonymised) events from your searches, preferably in raw format in codeblocks (using the </> button above)

Re: How to tie in 2 different event sources to display a field value from one source based on a value from the other sou

richgalloway — Wed, 13 Nov 2024 17:10:28 GMT

Yes, you said that in the OP, but what is the logic behind that matching? The query needs an algorithm it can use to pair servers with teams. Otherwise, you're looking at creating a lookup table that does the matching.