Splunk Search

Best way to correlate two sources

Builder

Hey everyone. We have a number of different sources. Each needs to be correlated with the others using either an ingress or egress ID. For example, in our first source, we have an egress ID since its where the process starts. The next server has an ingress ID and an egress ID, and so on until the final device.

All of our data sources are CSV files. First, what is the best way to correlate each of these sources?

Right now I'm looking at doing something like this:

search index=correlation sourcetype=source1
|eval ingress_id_for_source2=egress_call_id_from_source1
|join ingress_id_for_source2 [search index=correlation sourcetype=source2]

Something like this. I know this isn't optimum (and its probably not correct). Any suggestions? Please note this will happen multiple times. Stats won't work since we actually need the data from individual events, not aggregations of it. I want to chain all of the fields together to get a single record of the user's action across all of the systems.

Tags (1)
0 Karma

Splunk Employee
Splunk Employee
index=correlation sourcetype=source1 OR sourcetype=source2 
| eval key_field=if(sourcetype == 'source1', egress_call_id_from_source1, ingress_id_for_source2) 
| timechart count by key_field
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!