Splunk Search

Extract data from 2 different logs

chimuru84
Explorer

Hello community!

I want to extract data from 2 different logs like bellow:

Log 1: 2024-04-28 06:38:51 INFO Start auth for accountId=1, ip=192.168.1.1

Log 2: 2024-04-28 06:38:27 INFO Collect response for accountId=1, was: response=FINISH

For example for accountId=1 I have 10 logs with "Start auth", I mean 10 attempts of start auth.

In second log, for the same accountId I have 1 or more logs with FINISH.

I want to make a table like

accountId                              Start auth                                      FINISH

1                                                 10                                                       1

 

Could you helm me with this? 

Thank you.

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Have you already extracted accountId and response? If response does not have any value (null) does the event come from log1? If so, you could try something like this

| eval state=coalesce(response, "Start auth")
| chart count by accountId state

View solution in original post

chimuru84
Explorer

It works, thank you very much. One more thing, time filter isn't work, I mean if I set for 24H, search return logs for all time

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

This is a different question. Please start a new question with as much detail as possible.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Have you already extracted accountId and response? If response does not have any value (null) does the event come from log1? If so, you could try something like this

| eval state=coalesce(response, "Start auth")
| chart count by accountId state
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...