Splunk Enterprise

Searching Two Indexes with Different Fields

itsmevic
Communicator

Hey there Splunkers! I've got a quick question: 

1.) I'd like to search two indexes:  index=cloud and index=msad

2.) These indexes DO NOT contain the same fields

3.) I only need to pull from one field value in index=cloud:  Field: "protoPayload.metadata.event{}.eventName"

4.) I need to pull four field values from  index=msad:   Fields:  "whenCreated, whenChanged, sAMAccountName, eventtype"

I've tried using the below SPL but it isn't working.  Any assistance is greatly appreciated.

| set union
[search index=cloud
| fields protoPayload.metadata.event{}.eventName]
[search index=msad
| fields whenCreated,whenChanged,sAMAccountName,eventtype]
| table whenCreated,whenChanged,sAMAccountName,protoPayload.metadata.event{}.eventName,eventtype
| where sAMAccountName="gcp-org-admins"

 

Tags (2)
0 Karma

tscroggins
Motivator

@itsmevic 

Assuming events from both indexes have a sAMAccountName (case-sensitive) field, you can replace your Union with this:

index IN (cloud msad) sAMAccountName=gcp-org-admins

Following that, you need to determine what the events have in common in time and/or content. If the events have identical or closely bound _time values, for example, you may be able to use something like this:

index IN (cloud msad) sAMAccountName=gcp-org-admins
| bin _time span=1s
| stats 
latest(whenCreated) latest(whenChanged) latest(protoPayload.metadata.event{}.eventName) latest(eventtype) by _time sAMAccountName

0 Karma

richgalloway
SplunkTrust
SplunkTrust

"it isn't working" isn't a problem description.  Please describe the expected results and the results desired.

Are the fields mentioned in the fields common already extracted?  If not, then you'll need to extract them.

Since the two indexes have nothing in common, how do you expect Splunk to correlate the events?  If you have to do it by hand, how would you do it?

---
If this reply helps you, an upvote would be appreciated.
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>