Splunk Cloud Platform

new search - that will correlate against another search and output results in new field

verifi81
Path Finder

Hi Splunk Gurus,

I would like to know if this is possible.

Scenario: I have a webhook alert named Onboarding  

The output of that search has a field called Usernames1 which has 1000 entries.

I want to set up a new Alert called  Leaving and it will have it's own search which outputs another set data into a field called Usernames2


My problem: I want the Alert Leaving to compare it's field Username2 to Alert Onboarding field Usernames1 AND if there is a match, output the matching results to new field called match


A bit on the complex side but can that be done? Please help with syntax.

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...