Splunk Search

Compare field value from different sourcetypes to list the value of the third field

mardix86
New Member

Hi All,
i have 2 files indexed as 2 different source types.
In Sourcetype1 i created:
1. Field1 presents the value of a file let's say example.txt
2. Field2 presents the value of the result let's say [OK]

In Sourcetype2 i created:
Field1 presents the value of a file let's say example.txt

I would like to create a search that
If Field1 value from sourcetype1 = Field1 value from sourcetype2 list Field2 value from sourcetype1

My final goal is to create a table that lists the event details (time, user, files, results) the last column will be the result that is a little bit more trickier to achieve.

Thanks A Lot Guys!

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

There probably are a few ways to do that. Here's one.

sourcetype=sourcetype1 OR sourcetype=sourcetype2 | stats values(Field2) by Field1
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...