Splunk Search

Correlating logs from two different sources

sneha03
New Member

Hi Team,

I have two log sources ,say x and y.

For x we need to extract a field x1 and then for each x1 we need to take last six digit and search the logs from source y and we need to extract a field y1.

After this,we need to plot x1 vs y1.. and we need to find out x1 for which y1 is present and x1 for which y1 is not present.

 

Logically we need to showcase end to end journey of a transaction,where we have two different sources on same server.

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

This is too abstract - you could search one source based on another like this

search y [search x | eval query=substr(x1,-6,6) | dedup query | fields query | format]

But I am not sure where you would go from here, assuming this even searches y the way you are expecting to

0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...