Splunk Enterprise

How to replace field values received from one search result in one index with second search result in other index by comparing the values?

AdsicSplunk
New Member

Index 1 search result:-

Provider         IP             Version         Count
Provider1       10.10.10.1      1.0             30
Provider1       10.10.10.2      1.0             40
Provider1       10.10.10.3      1.0             100
Provider2       10.10.10.2      1.0             50
Provider2       10.10.10.2      1.0             75
Provider2       10.10.10.6      1.0             81
Provider3       10.10.10.3      1.0             25
Provider3       10.10.10.3      1.0             92
Provider4       10.10.10.4      1.0             20

Index 2 search result:-

<IPDetails>
   <Element1 Name="ABC">
      <Service Version="1.0">
         <Consumer EntityCode="Ent1">
            <IP>10.10.10.1</IP>
            <IP>10.10.10.2</IP>
            <IP>10.10.10.3</IP>
         </Consumer>
         <Consumer EntityCode="Ent2">
            <IP>10.10.10.4</IP>
            <IP>10.10.10.5</IP>
         </Consumer>
      </Service>
   </Element1>
   <Element2 Name="DEF">
      <Service Version="1.0">
         <Consumer EntityCode="Ent1">
            <IP>10.10.10.1</IP>
            <IP>10.10.10.2</IP>
            <IP>10.10.10.3</IP>
         </Consumer>
         <Consumer EntityCode="Ent3">
            <IP>10.10.10.6</IP>
            <IP>10.10.10.7</IP>
            <IP>10.10.10.8</IP>
         </Consumer>
      </Service>
   </API>
</APIDetails>

Could anyone advise me on how to replace the value of all IPs in IP field with second index's Consumer EntityCode, for example, "Ent1" should be replaced with 10.10.10.1 or 10.10.10.2 or 10.10.10.3, "Ent2" should be replaced with 10.10.10.4 or 10.10.10.5, "Ent3" should be replaced with 10.10.10.6 or 7 or 8?

Tags (1)
0 Karma

valiquet
Contributor

I don't have Splunk at the moment are your requirements are not clear, but I would try to do something with multivalue fields and spath

|search 1 ... | eval ip=mvcombine delim="," ip| map search="search 2 ...
| eval IPDetails.Element2.Service.Consumer{0}.IP{}=mvindex($ip$,0), IPDetails.Element2.Service.Consumer{1}.IP{}=mvindex($ip$,5), IPDetails.Element1.Service.Consumer{0}.IP{}=mvindex($ip$,8)"

0 Karma

AdsicSplunk
New Member

Thanks @valiquet but I got my query resolved by creating and using csv lookup.

0 Karma
Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...