Splunk Search

Extract value from first index and search in second index

ank15july96
Engager

Hi, I'm new to splunk so pardon if its a straightforward query

I want to extract userIds from my first index and check how many does not exist in second index

Example: index=auth-app would have field like  UID: H0XF7PQU1

So, I want to extract H0XF7PQU1 from first query and check if it exist in second query (index=main-app) and get count of ids that exist one first index but not in second. 

Conceptually, I want to get count of users that passed authentication (first index) but still did not make it to main application (second index)

Labels (5)
0 Karma
1 Solution

inventsekar
SplunkTrust
SplunkTrust

I am not sure, but, lets try this once...

index=main-app OR (index=auth-app "createsession") | rex field=_raw "UID: (?<uid>......)" | stats count(uid)

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !

View solution in original post

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi.. do you know if UID is extracted?

pls try

(index=auth-app OR index=main-app) UID

or, simply please try..

(index=auth-app OR index=main-app) H0XF7PQU1

update us your results, thanks.

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

ank15july96
Engager

Its a bit trickier than that
Here's my first query

index=auth-app "createSession" | rex field=_raw "UID: (?<uid>.*)"

And second query should be something like index=main-app uid | stats count

How do i put above two into what you suggested -- (index=auth-app OR index=main-app) UID | stats count

0 Karma

ank15july96
Engager

Okay, I tried this and this sorta works but one issue
Query:

index=main-app [search index=auth-app "createsession" | rex field=_raw "UID: (?<uid>......)" | table uid ] | stats count

The subquery results in something like this UID="XYZ" OR UID="ABC" etc so overall query becomes likes this

index=main-app UID="XYZ" OR UID="ABC"

But I just want to search as keyword in second index not as a UID field. So basically like this

index=main-app "XYZ" OR "ABC" 

How can I achieve this?

0 Karma

inventsekar
SplunkTrust
SplunkTrust

I am not sure, but, lets try this once...

index=main-app OR (index=auth-app "createsession") | rex field=_raw "UID: (?<uid>......)" | stats count(uid)

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

inventsekar
SplunkTrust
SplunkTrust

Please try...

index=main-app | join uid [search index=auth-app "createsession" | rex field=_raw "UID: (?<uid>......)" | fields uid ] | stats count

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...