Splunk Search

Compare field value from different sourcetypes to list the value of the third field

mardix86
New Member

Hi All,
i have 2 files indexed as 2 different source types.
In Sourcetype1 i created:
1. Field1 presents the value of a file let's say example.txt
2. Field2 presents the value of the result let's say [OK]

In Sourcetype2 i created:
Field1 presents the value of a file let's say example.txt

I would like to create a search that
If Field1 value from sourcetype1 = Field1 value from sourcetype2 list Field2 value from sourcetype1

My final goal is to create a table that lists the event details (time, user, files, results) the last column will be the result that is a little bit more trickier to achieve.

Thanks A Lot Guys!

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

There probably are a few ways to do that. Here's one.

sourcetype=sourcetype1 OR sourcetype=sourcetype2 | stats values(Field2) by Field1
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...