Splunk Cloud Platform

new search - that will correlate against another search and output results in new field

Path Finder

Hi Splunk Gurus,

I would like to know if this is possible.

Scenario: I have a webhook alert named Onboarding  

The output of that search has a field called Usernames1 which has 1000 entries.

I want to set up a new Alert called  Leaving and it will have it's own search which outputs another set data into a field called Usernames2

My problem: I want the Alert Leaving to compare it's field Username2 to Alert Onboarding field Usernames1 AND if there is a match, output the matching results to new field called match

A bit on the complex side but can that be done? Please help with syntax.

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...