Splunk Search

Compare two table searchers and combine to single table (where condition)

irvanrak
Engager

Hi,

Got two different searches result in to corresponding table format, want to achieve something like "select b.column1, b.column2 from table a, table b where a.column1 = b.column1" in single search.

Table 'a' contain a single column named TransactionID where table 'b' contain two columns named TransactionID , Errors

Search 1 : index=app source=.log "FATAL" | rex "some value (?.+) somemore" | table TID
Search 2 : index=app source=
.log "ERROR_TEXT" | rex "some value (?.+) somemore" | rex field=_raw "some txt (?.+)" | table TID, ErrorText

Required output like "select b.column1, b.column2 from table a, table b where a.column1 = b.column1" in single search.

0 Karma
1 Solution

somesoni2
Revered Legend

Try like this

 index=app source=*.log ("FATAL" OR "ERROR_TEXT" )
| fields _raw | eval type=if(match(_raw,"FATAL"),"FATAL","ERROR")
| rex "some value (?<TID>.+) somemore" 
| rex field=_raw "some txt (?<ErrorText>.+)" 
| stats values(ErrorText) as ErrorText dc(type) as type by TID
| where type=2

The where clause ensures that we're only considering TIDs which are available in both type of records (fatal and error).

View solution in original post

somesoni2
Revered Legend

Try like this

 index=app source=*.log ("FATAL" OR "ERROR_TEXT" )
| fields _raw | eval type=if(match(_raw,"FATAL"),"FATAL","ERROR")
| rex "some value (?<TID>.+) somemore" 
| rex field=_raw "some txt (?<ErrorText>.+)" 
| stats values(ErrorText) as ErrorText dc(type) as type by TID
| where type=2

The where clause ensures that we're only considering TIDs which are available in both type of records (fatal and error).

irvanrak
Engager

Thanks a lot, got exactly what i was looking for.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...