Splunk Enterprise

How to replace field values received from one search result in one index with second search result in other index by comparing the values?

AdsicSplunk
New Member

Index 1 search result:-

Provider         IP             Version         Count
Provider1       10.10.10.1      1.0             30
Provider1       10.10.10.2      1.0             40
Provider1       10.10.10.3      1.0             100
Provider2       10.10.10.2      1.0             50
Provider2       10.10.10.2      1.0             75
Provider2       10.10.10.6      1.0             81
Provider3       10.10.10.3      1.0             25
Provider3       10.10.10.3      1.0             92
Provider4       10.10.10.4      1.0             20

Index 2 search result:-

<IPDetails>
   <Element1 Name="ABC">
      <Service Version="1.0">
         <Consumer EntityCode="Ent1">
            <IP>10.10.10.1</IP>
            <IP>10.10.10.2</IP>
            <IP>10.10.10.3</IP>
         </Consumer>
         <Consumer EntityCode="Ent2">
            <IP>10.10.10.4</IP>
            <IP>10.10.10.5</IP>
         </Consumer>
      </Service>
   </Element1>
   <Element2 Name="DEF">
      <Service Version="1.0">
         <Consumer EntityCode="Ent1">
            <IP>10.10.10.1</IP>
            <IP>10.10.10.2</IP>
            <IP>10.10.10.3</IP>
         </Consumer>
         <Consumer EntityCode="Ent3">
            <IP>10.10.10.6</IP>
            <IP>10.10.10.7</IP>
            <IP>10.10.10.8</IP>
         </Consumer>
      </Service>
   </API>
</APIDetails>

Could anyone advise me on how to replace the value of all IPs in IP field with second index's Consumer EntityCode, for example, "Ent1" should be replaced with 10.10.10.1 or 10.10.10.2 or 10.10.10.3, "Ent2" should be replaced with 10.10.10.4 or 10.10.10.5, "Ent3" should be replaced with 10.10.10.6 or 7 or 8?

Tags (1)
0 Karma

valiquet
Contributor

I don't have Splunk at the moment are your requirements are not clear, but I would try to do something with multivalue fields and spath

|search 1 ... | eval ip=mvcombine delim="," ip| map search="search 2 ...
| eval IPDetails.Element2.Service.Consumer{0}.IP{}=mvindex($ip$,0), IPDetails.Element2.Service.Consumer{1}.IP{}=mvindex($ip$,5), IPDetails.Element1.Service.Consumer{0}.IP{}=mvindex($ip$,8)"

0 Karma

AdsicSplunk
New Member

Thanks @valiquet but I got my query resolved by creating and using csv lookup.

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...