Splunk Search

Combine multiple search fields

Path Finder


We have a scenario where we have three different events that should combine together based on Event ID.  


Event 1 Fields: 

  • Hostname 
  • Unique_ID 
  • Has_Vulnerabilities 

 Event 2 Fields: 

  • Scan_Date 
  • Hostname_Unique_ID 
  • Vulnerability_Id 

 Event 3 Fields: 

  • Vulnerability_id 
  • Description 
  • Start_Date 

What we are trying to do is, when I click on “Event 1 Unique_ID” to get all Vulnerabilities for Selected Host for “Event 2” enriched with selected data from “Event 3”. 

All three events are in the same index but different sourcetype.  

What is the best approach here? Subsearch seems slow If I go “Event 2” first and then filter to “Event 1”. I want another way around.  

Labels (2)
0 Karma


Can you clarify if you want an dashboard (as you are talking about clicks) and drill down to those events by individual hosts or do you want one query which contains all that info?

I suppose that Hostname == Hostname_Unique_ID or is there some other field on event 1 to match those?

r. Ismo

0 Karma

Path Finder

Eventually I will create dashboard. For now, search is enough just to get me going 🙂

we can use hostname=hostname_unique_id

0 Karma
Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of the streaming infrastructure for Splunk APM and Splunk RUM in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...