Splunk Enterprise

How to replace field values received from one search result in one index with second search result in other index by comparing the values?

AdsicSplunk
New Member

Index 1 search result:-

Provider         IP             Version         Count
Provider1       10.10.10.1      1.0             30
Provider1       10.10.10.2      1.0             40
Provider1       10.10.10.3      1.0             100
Provider2       10.10.10.2      1.0             50
Provider2       10.10.10.2      1.0             75
Provider2       10.10.10.6      1.0             81
Provider3       10.10.10.3      1.0             25
Provider3       10.10.10.3      1.0             92
Provider4       10.10.10.4      1.0             20

Index 2 search result:-

<IPDetails>
   <Element1 Name="ABC">
      <Service Version="1.0">
         <Consumer EntityCode="Ent1">
            <IP>10.10.10.1</IP>
            <IP>10.10.10.2</IP>
            <IP>10.10.10.3</IP>
         </Consumer>
         <Consumer EntityCode="Ent2">
            <IP>10.10.10.4</IP>
            <IP>10.10.10.5</IP>
         </Consumer>
      </Service>
   </Element1>
   <Element2 Name="DEF">
      <Service Version="1.0">
         <Consumer EntityCode="Ent1">
            <IP>10.10.10.1</IP>
            <IP>10.10.10.2</IP>
            <IP>10.10.10.3</IP>
         </Consumer>
         <Consumer EntityCode="Ent3">
            <IP>10.10.10.6</IP>
            <IP>10.10.10.7</IP>
            <IP>10.10.10.8</IP>
         </Consumer>
      </Service>
   </API>
</APIDetails>

Could anyone advise me on how to replace the value of all IPs in IP field with second index's Consumer EntityCode, for example, "Ent1" should be replaced with 10.10.10.1 or 10.10.10.2 or 10.10.10.3, "Ent2" should be replaced with 10.10.10.4 or 10.10.10.5, "Ent3" should be replaced with 10.10.10.6 or 7 or 8?

Tags (1)
0 Karma

valiquet
Contributor

I don't have Splunk at the moment are your requirements are not clear, but I would try to do something with multivalue fields and spath

|search 1 ... | eval ip=mvcombine delim="," ip| map search="search 2 ...
| eval IPDetails.Element2.Service.Consumer{0}.IP{}=mvindex($ip$,0), IPDetails.Element2.Service.Consumer{1}.IP{}=mvindex($ip$,5), IPDetails.Element1.Service.Consumer{0}.IP{}=mvindex($ip$,8)"

0 Karma

AdsicSplunk
New Member

Thanks @valiquet but I got my query resolved by creating and using csv lookup.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...