Splunk Search

How to search two different values in different text files which has same index?

gladiatorankit
Explorer

How to search two different values both the values are in different text files which has the same index and the final output want to route to a different txt file.

Tags (1)
0 Karma
1 Solution

gfuente
Motivator

Something like:

index="commonindex" (source="source1" field1="value1") OR (source="source2" field1="value2")

???

View solution in original post

gfuente
Motivator

Something like:

index="commonindex" (source="source1" field1="value1") OR (source="source2" field1="value2")

???

gladiatorankit
Explorer

Yes this worked. Thanks alot. Actually I have 1 value in File A and another in File B. I want to combine the search result and route it to different file. Please tell me how should I route the result to different file?

0 Karma

gfuente
Motivator

index=main (source="123.txt" "123") OR (source="456.txt" "456")

Im sorry, but i don´t understand what you need.

gladiatorankit
Explorer

I have two text files 123.txt and 456.txt and the values are 123 and 456 in the respective files.

I want to search such that both the files should appear when searched using values "123" and "456" and I want the output "123456" in another file.

0 Karma

gfuente
Motivator

Then:

index=main (source="source1" OR source="source2") 123

Is this what you are looking for?

0 Karma

gladiatorankit
Explorer

Well this is exactly not working. I can only search for one value how will I search for another one?
My search :-
index=main source="F:\123.txt" 123
But what if I want to add one more different source and search in that too?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...