Splunk Search

Correlating logs from two different sources

sneha03
New Member

Hi Team,

I have two log sources ,say x and y.

For x we need to extract a field x1 and then for each x1 we need to take last six digit and search the logs from source y and we need to extract a field y1.

After this,we need to plot x1 vs y1.. and we need to find out x1 for which y1 is present and x1 for which y1 is not present.

 

Logically we need to showcase end to end journey of a transaction,where we have two different sources on same server.

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

This is too abstract - you could search one source based on another like this

search y [search x | eval query=substr(x1,-6,6) | dedup query | fields query | format]

But I am not sure where you would go from here, assuming this even searches y the way you are expecting to

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...