Splunk Search

Get loginID correlating to another event

New Member

Hi everyone,

I'm currently struggling getting the results I want to receive.

I have a different set of logs, but only need information from two of them. One which logs the method used and another log which contains information about the users.

The objective is, to only extract loginIDs which are relating to events happend in the method logs. The only relation between them, is the sessionID, but the amount of logfiles contains so many entries, that a join is just unpractical.

Example Logfiles:

2019-02-20T09:15:10+01:00 hostname_02 server_name: 2019-02-20 09:15:10 INFO  <<<<< object=BackendService_v08, method=getUsername, clID=123456789abcdefg


2019-02-20T09:15:15+01:00 hostname_02 server_name: 2019-02-20 09:15:15 INFO  (source='session, httpSessionId='123456789abcdefg') RuntimeUserInfo (loginId='dummy' firstName='Test' lastName='User' userId='1234' clientId='99')

I now want to extract the loginId of the relating user (1234) and the method (getUsername). It is possible, that a user executed more than just one method, which then should be grouped by the clientId. However, the only shared information is the clID which is stored in the httpSessionId. Because of approximately 8 million events, a join containing a subsearch is regarding execution time no appropriate solution.

Is there any feasible way to correlate those events and get the userId together with its used methods?

Thanks in advance.


0 Karma


Yeah, you don't want to use join. Let's pretend your sourcetypes are "msglog" and "infolog":

(index=A sourcetype=msglog) OR (index=B sourcetype=infolog) 
| eval id=case(sourcetype="msglog",clID,sourcetype="infolog",httpSessionId)
| stats values(userId) as userId values(method) as method by id

should get be pretty close to what you want.

Tip: Look up the "Let stats sort them out" session recording by Nick Mealy at .conf2016 🙂


0 Karma


If you have one user per session, then try

(source="first log file" OR source="second log file")  "other search terms" 
|rename clID as httpSessionId
|stats values(userId) as userId,values(method) as method by httpSessionId
0 Karma

New Member


This actually comes pretty close. It groups the findings of the used methods by the SessionId, but unfortunately doesn't list any loginId at all.

After a small modification and correcting a typo I made, it seems like it works like a charm. Thank you very much, that saves a lot of time.

0 Karma

New Member


thanks for your suggestion. Unfortunately a user can have different sessions over time. Sorry, that I forgot to mention that in my previous post.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!