Splunk Search

Best way to correlate two sources

msarro
Builder

Hey everyone. We have a number of different sources. Each needs to be correlated with the others using either an ingress or egress ID. For example, in our first source, we have an egress ID since its where the process starts. The next server has an ingress ID and an egress ID, and so on until the final device.

All of our data sources are CSV files. First, what is the best way to correlate each of these sources?

Right now I'm looking at doing something like this:

search index=correlation sourcetype=source1
|eval ingress_id_for_source2=egress_call_id_from_source1
|join ingress_id_for_source2 [search index=correlation sourcetype=source2]

Something like this. I know this isn't optimum (and its probably not correct). Any suggestions? Please note this will happen multiple times. Stats won't work since we actually need the data from individual events, not aggregations of it. I want to chain all of the fields together to get a single record of the user's action across all of the systems.

Tags (1)
0 Karma

araitz
Splunk Employee
Splunk Employee
index=correlation sourcetype=source1 OR sourcetype=source2 
| eval key_field=if(sourcetype == 'source1', egress_call_id_from_source1, ingress_id_for_source2) 
| timechart count by key_field
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...