Splunk Search

Combine multiple search fields

Path Finder


We have a scenario where we have three different events that should combine together based on Event ID.  


Event 1 Fields: 

  • Hostname 
  • Unique_ID 
  • Has_Vulnerabilities 

 Event 2 Fields: 

  • Scan_Date 
  • Hostname_Unique_ID 
  • Vulnerability_Id 

 Event 3 Fields: 

  • Vulnerability_id 
  • Description 
  • Start_Date 

What we are trying to do is, when I click on “Event 1 Unique_ID” to get all Vulnerabilities for Selected Host for “Event 2” enriched with selected data from “Event 3”. 

All three events are in the same index but different sourcetype.  

What is the best approach here? Subsearch seems slow If I go “Event 2” first and then filter to “Event 1”. I want another way around.  

Labels (2)
0 Karma


Can you clarify if you want an dashboard (as you are talking about clicks) and drill down to those events by individual hosts or do you want one query which contains all that info?

I suppose that Hostname == Hostname_Unique_ID or is there some other field on event 1 to match those?

r. Ismo

0 Karma

Path Finder

Eventually I will create dashboard. For now, search is enough just to get me going 🙂

we can use hostname=hostname_unique_id

0 Karma
Get Updates on the Splunk Community!

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...

Platform Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestIntroducing Splunk Edge Processor, simplified data ...