Correlating two indexes data

[abhayneilam]

Hi,

I have a correlation ID in one index

( index="AAA" | rex "XXXXXX\]\[(?.*?)\]" )  

which I want to match with the correlation ID of other index ,

( index="BBB" | rex "CCCCCCC\]\[(?.*?)\]" )

Once matched I want to get the total count of how many correlation ID mathces between these two Indexes.

Please help me to get the results.

[MuS · Accepted solution]

Hi abhayneilam,

based on the provided information, which is by the way very little, try something like this:

index="AAA" OR index="BBB"  
| rex "XXXXXX\]\[(?<myID>.*?)\]" 
| rex "CCCCCCC\]\[(?<myID>.*?)\]" 
| streamstats window=2 last(myID) AS last_myID 
| where myID=last_myID 
| stats count by myID

This should give you an idea or take a closer look at this answer
http://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-joi...

hope this helps ...

cheers, MuS

[abhayneilam]

Thanks a lot !! 🙂

[abhayneilam]

so for both the Indexes , do we need to keep the same filed name as "Correlation_ID"

[splunker12er]

index="AAA" | rex "XXXXXX][(?.?)]" | append [search index="BBB" | "CCCCCCC][(?.?)]" ] | stats count by correlaion_ID

tried this ?