Splunk Search

Help using multiple sources

tt1
Explorer

Hi, I am successfully reading and joining a couple of sources, but am having a trouble adding a 3rd.

index=access_logs TTG  | 
rex field=_raw "\"GET\s*.*?xml\?*(?<ttg_request>.*?)\s*HTTP.*?\"" | 
rex field=ttg_request "c_account_code=(?<ttg_c_account_code>.*?)&" | 
rex field=ttg_request "c_error_code=(?<ttg_c_error_code>.*?)&" |  
rex field=ttg_request "c_time_stamp=(?<ttg_c_time_stamp>.*?)&" | 
rename ttg_c_account_code as addressID | 
join addressID [search index="tt2_trial_accounts"] | 
table addressID accountCode ttg_c_error_code ttg_c_time_stamp

the 3rd

index=json_mi | table accountCode event.type date

I want to join like this;

index=access_logs OR index=json_mi |

but do not know how to handle the above rex fields in this instance.

Ideally ending up with something that looks like;

table accountCode some_field(ttg_c_error_code or event.type date) date(ttg_c_time_stamp or date)

Any help appreciated.

Tags (3)
0 Karma

Ledion_Bitincka
Splunk Employee
Splunk Employee

We need a bit more info to help with crafting the search, however generally you can use the following template to "join" data sets

<search for all the data> | <eval/extract all the needed fields> | stats <aggregates, fields ...> BY <fields you want to join>
0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...