Splunk Search

Comparing 2 Atrributes in different indexes

shinobu
Loves-to-Learn Lots

I have stored data in 2 indexes. One Index has a attribute which can be a substring of the second index _raw event data format. I want to generate a List for every substring that was found inside that row event. Any ideas how i can accomplish this? Thank you.

I tried something like: 

 

 

index="index2" | rename _raw as raw | map search="search index=\"index1\" | where like($raw$,\"%\".field1.\"%\")" 

 

 

For some reason there is no field "result" in my output.

Labels (3)
0 Karma

venkatasri
Influencer

Hi @shinobu 

Subquery might work in your case, 

index=index2  [search index=index1 | fields your_attribute_field | rename your_attribute_field as search]

With above query the events from index2 getting filtered only having your required attribute.

----------------------------------------------

An upvote would be appreciated if it helps!

0 Karma

maciep
Champion

Not entirely sure if i understand what you're after, but from what I can gather, I think I would go the opposite away - get the field values, then map those into a search of index2.  Something like below maybe?  The regex could change depending on your definition of "substring".

Also if you just wanted the events that match in general (and not needing the actual substrings), a simple subsearch may be better, not sure.

index=index1 | stats count by field1 
| map search="search index=\"index2\" | rex max_match=0 \"(?i)(?<substrings>\w*$field1$\w*)\""
| where isnotnull(substrings)
| table substrings, _raw

 

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!