topic Re: how to do a match field between index and summary index Finding match TraceID in Splunk Search

how to do a match field between index and summary index Finding match TraceID

Cheng2Ready — Fri, 11 Jul 2025 20:51:31 GMT

Without using a SubSearch since there is a limit of 10000 results

index="xxxx" field.type="xxx" OR index=Summary_index
| eventstats values(index) as sources by trace
| where mvcount(sources) > 1

Still doesn't return any results

Re: how to do a match field between index and summary index Finding match TraceID

ITWhisperer — Fri, 11 Jul 2025 21:55:15 GMT

Try removing lines from th end of the search, one at a time, until the results appear, then you will know which line is causing the problem.

If that doesn't work, try sharing some events from the index and the summary index to show us what you are dealing with.

Re: how to do a match field between index and summary index Finding match TraceID

gcusello — Sat, 12 Jul 2025 05:38:40 GMT

Hi @Cheng2Ready ,

at first don't rename hour_bucket,

then don't use values in timechart command,

then why are you using all these stats?

at least why do you want to list all the values of count without the yyyId? what do you want to extract?

please try:

(index="xxxx" field.type="xxx") OR index=Summary_index | eventstats values(index) as sources by trace | where mvcount(sources) > 1 | spath output=yyyId path=xxxId input=_raw | where isnotnull(yyyId) ANDyyyId!="" | bin _time span=5m | stats latest(_time) AS last_activity_in_hour count BY _time yyyId | stats values(count) AS "Unique Customers per Hour" BY _time

Could you share more detals about your requirement?

Ciao.

Giuseppe

Re: how to do a match field between index and summary index Finding match TraceID

PickleRick — Sat, 12 Jul 2025 05:57:28 GMT

1. We don't know neither your events nor your summary index contents.

2. There is much going on here. Try to avoid eventstats if possible. It's a "heavy" command and can run out of memory.

3. You bin by 5m but name your fields as if it was hourly.

4. You're generating several fields which you don't use later.