Getting Data In

How to create a search from multiple sourcetypes?

kteng2024
Path Finder

Hi,

Below are the three different source types from which I am trying to get the specific values as highlighted.

sourcetype: cg_log

2017-02-15T05:47:45.107+1100:
123564.781: [GC 123564.781: [ParameterNew: 637043K, 0.004 secs] 120590K->600476K(20761856K), 0.004 secs]

sourcetype: resp_log

2017-02-15 05:51:09.012890 id:155678,name:[AB05:RMS] Prod: apacheweb : Pool15 application pool,hostname:apacheweb.com,resptime:1378

sourcetype: jmx

2017-02-14 15:49:53 apacheweb.eu.com 318568616

Can someone please help me with the search . Below is the search i tried so far,

> sourcetype=cg_log GC [search
> sourcetype=resp_log resptime | table
> resptime GC]

muebel
SplunkTrust
SplunkTrust

Hi kteng,

I might not be following exactly what you are getting at, but this search will turn up all results from those sourcetypes, and do extractions for those fields

(sourcetype=cg_log OR sourcetype=resp_log OR sourcetype=jmx) | rex ".*GC\s(?<GC>[^:]+):.*" | rex ".*resptime:(?<resptime>\d+)\D" | rex ".*\s(?<jmx_field>\d+)$"

Or, at least, those regexes should be close.

The important might be to notice that the initial search string has a couple ORs to say "I want all results for these three sourcetypes"

Once you have those results, you can do whatever processing you like, as well as additional filtering.

Please let me know if this answers your question! 😄

Get Updates on the Splunk Community!

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

 Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research Team (STRT) and ...