topic Re: How do I make a couple of indices in one table? in Splunk Search

How do I make a couple of indices in one table?

eyaluodba — Tue, 23 May 2017 19:45:13 GMT

Is it possible to have two different indices and have results in a single table? The Indices are...

index=_internal source=*web_access.log* /app/  action=edit | rex  "/app/(?<app_name>.\w+)/(?<dashboard_name>.\w+)" | table dashboard_name, _time, app_name, user

and

index=_audit action=search info=granted search=* NOT "search_id='scheduler" NOT "search='|history" NOT "user=splunk-system-user" NOT "search='typeahead" NOT "search='| metadata type=* | search totalCount>0" | rex field=search "index=(?P<search_index>[^ ]+)" | stats count by search_index | sort - count| table search_index user

Please let me know! Thank you so much.

Re: How do I make a couple of indices in one table?

woodcock — Tue, 23 May 2017 20:05:56 GMT

You can join searches many ways but almost all of them are subjected to the 50Kish event limit so beware this:

index=_internal source=*web_access.log* /app/ action=edit 
| rex "/app/(?<app_name>.\w+)/(?<dashboard_name>.\w+)" 
| table dashboard_name, _time, app_name, user 
| append 
[ search index=_audit action=search info=granted search=* NOT "search_id='scheduler" NOT "search='|history" NOT "user=splunk-system-user" NOT "search='typeahead" NOT "search='| metadata type=* | search totalCount>0" 
| rex field=search "index=(?P<search_index>[^ ]+)" 
| stats count by search_index 
| sort - count 
| table search_index user]

Re: How do I make a couple of indices in one table?

MuS — Tue, 23 May 2017 20:08:47 GMT

Hi eyaluodba,

Sure, read more about the topic in this answer https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-join-append-or-use-of-subsearches.html or in the Virtual .conf March 2016 session over here http://wiki.splunk.com/Virtual_.conf

For a start just combine your base searches:

( index=_internal source=*web_access.log* /app/  action=edit ) OR ( index=_audit action=search info=granted search=* NOT "search_id='scheduler" NOT "search='|history" NOT "user=splunk-system-user" NOT "search='typeahead" NOT "search='| metadata type=* | search totalCount>0" )

followed by any further commands you need to get to your required result.

Hope that helps ...

cheers, MuS

Re: How do I make a couple of indices in one table?

eyaluodba — Tue, 23 May 2017 20:15:32 GMT

Thank you !

Re: How do I make a couple of indices in one table?

eyaluodba — Tue, 23 May 2017 20:21:40 GMT

Thank you!