Splunk Search

Correlating logs from two different sources

sneha03
New Member

Hi Team,

I have two log sources ,say x and y.

For x we need to extract a field x1 and then for each x1 we need to take last six digit and search the logs from source y and we need to extract a field y1.

After this,we need to plot x1 vs y1.. and we need to find out x1 for which y1 is present and x1 for which y1 is not present.

 

Logically we need to showcase end to end journey of a transaction,where we have two different sources on same server.

 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

This is too abstract - you could search one source based on another like this

search y [search x | eval query=substr(x1,-6,6) | dedup query | fields query | format]

But I am not sure where you would go from here, assuming this even searches y the way you are expecting to

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...