Getting Data In

How can I merge two splunk queries together?

Taibat02230232
Loves-to-Learn

I have two Splunk queries 1 and 2 below, and both have one common email , i want the searched emails generated from the result which are email variable to be able to send an alert notification base on the search result generated email.

I need the common value to have the field with matching values in both queries which is the email , then be able to send an email alert notification

Query-1

index="aws-cloudtrail" eventName="AssumeRoleWithSAML" |fields *
| spath "requestParameters.roleArn" |search "*super*admin*"
| rex field=responseElements.subject "(?<Email>[a-zA-Z0-9]{1,8}@digitlogs.com$)"
| search Email=*
| table Email,"recipientAccountId"
| dedup Email, "recipientAccountId"

Query-2

index="okta" displayMessage="Authenticate user with AD agent"
| rename target{}.alternateId as email
| eval my_ponies=mvindex(email, -3, -2)
| eval Email=mvindex(email, 0)
| eval email=mvindex(email, 1)
| table Email email

Here are the two of them, please any input will help

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Taibat02230232,

if you're sure that one of the searches has less than 50,000 results, you can use append:

index="aws-cloudtrail" eventName="AssumeRoleWithSAML" 
| spath "requestParameters.roleArn" 
| search "*super*admin*"
| rex field=responseElements.subject "(?<Email>[a-zA-Z0-9]{1,8}@digitlogs.com$)"
| search Email=*
| table Email,"recipientAccountId"
| dedup Email, "recipientAccountId"
| append search
   index="okta" displayMessage="Authenticate user with AD agent"
   | rename target{}.alternateId as email
   | eval my_ponies=mvindex(email, -3, -2)
   | eval Email=mvindex(email, 0)
   | eval email=mvindex(email, 1)
   | table Email email
   ]
| stats 
   values(recipientAccountId) AS recipientAccountId 
   values(email) AS email 
   BY Email

otherwise you have to use a more complex search.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...