topic Re: How to output matching fields in Splunk Search

How to output matching fields

harshavrath — Mon, 28 Apr 2014 13:29:33 GMT

Hi,

I have indexed few records from my DB into Splunk & an log file is also indexed into Splunk. There is one matching Field in both the indexed sources i.e, Serial Number.

My question is how can i output only the matching Events with the same Serial Number using Splunk Search.

Any Help is Appreciated,

Thanks.

Re: How to output matching fields

richgalloway — Mon, 28 Apr 2014 14:28:26 GMT

Here's one way:

<DB search> | join SerialNumber [<log file search>] | ...

Re: How to output matching fields

harshavrath — Mon, 28 Sep 2020 16:29:29 GMT

source="logFILE"| rex field=_raw "(?i) Number: (?P[^ ]+)"|join SERIAL_NUM_CD[search source="IndexeddbDATA"]
I tried the above query its working, but other non matching fields are also displayed.

Re: How to output matching fields

somesoni2 — Mon, 28 Sep 2020 16:29:31 GMT

The case of field extracted and field used for join is different. Splunk is case sensitive in field names (always). ALso, check if you have field SERIAL_NUM_CD in the source IndexeddbDATA with same case.

Re: How to output matching fields

harshavrath — Tue, 29 Apr 2014 14:14:45 GMT

in query its Caps only, after i commented it was automatically converted into lower case.

Re: How to output matching fields

richgalloway — Tue, 29 Apr 2014 14:17:37 GMT

It would be helpful to see some sample events from each source.

Re: How to output matching fields

harshavrath — Mon, 28 Sep 2020 16:31:19 GMT

The query that I used is

source="Logfile.log" | rex field=_raw "(?i) Number: (?P[^ ]+)" | search SERIAL_NUM_CD="*" | join SERIAL_NUM_CD[search source="IndexeddbDATA"]

I’m able to get the matching fields as output from the Log file but my requirement is I want the matching fields from both the log as well as DB to be displayed.

Re: How to output matching fields

richgalloway — Fri, 02 May 2014 11:44:09 GMT

You showed your query previously. Now we need to see sample events.