Splunk Search

Can anyone suggest how I can create a join query using pattern

ayush8878
New Member

Eg
eg in fuse.log I have a entry like userId=abc
while in access.log i have entry like sessionid-12232 | abc | xyz
Output I want is like
abc | xyz | sessionid-12232
Can you please suggest how can i join these two using pattern

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Assuming access.log has fields 'sessionid', 'userid', and 'foo' and they're already extracted then this should get you started.

source=fuse.log OR source=access.log | stats values(*) as * by userid | table userid foo sessionid
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

to4kawa
Ultra Champion
| makeresults
| eval _raw="userId=abc,session=123,time=12:00_IST"
| kv
| eval time=replace(time,"_"," ")
| append 
    [| makeresults 
    | eval _raw="foo-abc-12:00 IST-data" ]
`comment("this is sample data")`
| rex "(?<user>[^\-]+)-(?<userId>[^\-]+)-(?<time>[^\-]+)-(?<data>.+)"
| stats values(*) as * by userId 
| eval session="sessionid-".session
| table userId user session

I uased @richgalloway 's query, thanks.

 source=fuse.log OR source=access.log 
| rex "(?<user>[^\-]+)-(?<userId>[^\-]+)-(?<time>[^\-]+)-(?<data>.+)"
| stats values(*) as * by userid 
| eval session="sessionid-".session
| table userid user sessionid

How about this?

0 Karma

ayush8878
New Member

Thanks @richgalloway @to4kawa

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Assuming access.log has fields 'sessionid', 'userid', and 'foo' and they're already extracted then this should get you started.

source=fuse.log OR source=access.log | stats values(*) as * by userid | table userid foo sessionid
---
If this reply helps you, Karma would be appreciated.
0 Karma

ayush8878
New Member

hey, Thank you very much for the response but the scenario is little different
in fuse.log I have fields like
userId=abc | session=123 | time=12:00 IST
so splunk is able to concider then as 3 fields i.e. userId,session,time
while in access.log i only have values but not field name i.e
foo-abc-12:00 IST-data
What I need to achieve is get the userid from fuse.log and find that id in access.log and print userid |session | data

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This information should have been included in the question.
@to4kawa's answer should do the job.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...