Splunk Enterprise

How to replace field values received from one search result in one index with second search result in other index by comparing the values?

AdsicSplunk
New Member

Index 1 search result:-

Provider         IP             Version         Count
Provider1       10.10.10.1      1.0             30
Provider1       10.10.10.2      1.0             40
Provider1       10.10.10.3      1.0             100
Provider2       10.10.10.2      1.0             50
Provider2       10.10.10.2      1.0             75
Provider2       10.10.10.6      1.0             81
Provider3       10.10.10.3      1.0             25
Provider3       10.10.10.3      1.0             92
Provider4       10.10.10.4      1.0             20

Index 2 search result:-

<IPDetails>
   <Element1 Name="ABC">
      <Service Version="1.0">
         <Consumer EntityCode="Ent1">
            <IP>10.10.10.1</IP>
            <IP>10.10.10.2</IP>
            <IP>10.10.10.3</IP>
         </Consumer>
         <Consumer EntityCode="Ent2">
            <IP>10.10.10.4</IP>
            <IP>10.10.10.5</IP>
         </Consumer>
      </Service>
   </Element1>
   <Element2 Name="DEF">
      <Service Version="1.0">
         <Consumer EntityCode="Ent1">
            <IP>10.10.10.1</IP>
            <IP>10.10.10.2</IP>
            <IP>10.10.10.3</IP>
         </Consumer>
         <Consumer EntityCode="Ent3">
            <IP>10.10.10.6</IP>
            <IP>10.10.10.7</IP>
            <IP>10.10.10.8</IP>
         </Consumer>
      </Service>
   </API>
</APIDetails>

Could anyone advise me on how to replace the value of all IPs in IP field with second index's Consumer EntityCode, for example, "Ent1" should be replaced with 10.10.10.1 or 10.10.10.2 or 10.10.10.3, "Ent2" should be replaced with 10.10.10.4 or 10.10.10.5, "Ent3" should be replaced with 10.10.10.6 or 7 or 8?

Tags (1)
0 Karma

valiquet
Contributor

I don't have Splunk at the moment are your requirements are not clear, but I would try to do something with multivalue fields and spath

|search 1 ... | eval ip=mvcombine delim="," ip| map search="search 2 ...
| eval IPDetails.Element2.Service.Consumer{0}.IP{}=mvindex($ip$,0), IPDetails.Element2.Service.Consumer{1}.IP{}=mvindex($ip$,5), IPDetails.Element1.Service.Consumer{0}.IP{}=mvindex($ip$,8)"

0 Karma

AdsicSplunk
New Member

Thanks @valiquet but I got my query resolved by creating and using csv lookup.

0 Karma
Get Updates on the Splunk Community!

.conf23 Registration is Now Open!

Time to toss the .conf-etti &#x1f389; —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...