Splunk Search

Extract data from 2 different logs

chimuru84
Explorer

Hello community!

I want to extract data from 2 different logs like bellow:

Log 1: 2024-04-28 06:38:51 INFO Start auth for accountId=1, ip=192.168.1.1

Log 2: 2024-04-28 06:38:27 INFO Collect response for accountId=1, was: response=FINISH

For example for accountId=1 I have 10 logs with "Start auth", I mean 10 attempts of start auth.

In second log, for the same accountId I have 1 or more logs with FINISH.

I want to make a table like

accountId                              Start auth                                      FINISH

1                                                 10                                                       1

 

Could you helm me with this? 

Thank you.

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Have you already extracted accountId and response? If response does not have any value (null) does the event come from log1? If so, you could try something like this

| eval state=coalesce(response, "Start auth")
| chart count by accountId state

View solution in original post

chimuru84
Explorer

It works, thank you very much. One more thing, time filter isn't work, I mean if I set for 24H, search return logs for all time

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

This is a different question. Please start a new question with as much detail as possible.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Have you already extracted accountId and response? If response does not have any value (null) does the event come from log1? If so, you could try something like this

| eval state=coalesce(response, "Start auth")
| chart count by accountId state
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...