Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Combining 2 different search results based on fiel...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
I have 2 different searches for 2 different sourcetypes with field extractions. I'm doing the field extractions for search1 for xml data.
search1:
sourcetype=xmlapp | xmlkv
search2:
sourcetype=app2
I'd like to combine searches in such a way that when field2 from search2 does NOT match any existing field1 from search1, I need to create an alert. Any help is greatly appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I believe something like this should work:
sourcetype=xmlapp | xmlkv | search NOT [search sourcetype=app2 | rename field2 as field1 | fields field1]
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I believe something like this should work:
sourcetype=xmlapp | xmlkv | search NOT [search sourcetype=app2 | rename field2 as field1 | fields field1]
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @pramit46, I renamed it because the requirement was that values from field2 in the subsearch would be matched to values of field1 in the main search.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@Ayn, Can you please explain why did you rename the field2?
I also have the same question as that in Selim's comment. Any help would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you. That works for finding the events. So, how do display more fields (e.g. field1, field2, field3 from search#1 and field4, field5 from search#2) to the results so that I can display them in a table (or chart)? I tried fields command but was not successful.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
