Splunk Search

How can I display values of a common field occurring in two different event ID's?

ASTARS47
New Member

There are various event codes like eventID = "123" , eventID ="456", eventID = "789" . There are some "appID"   fields that occurs in both eventID = "123"  AND eventID ="456"  (not all "appID" occur in both these eventID) . So I want to display a list of values from all those "appID"  field which are occurring in both the eventID = "123"  AND eventID ="456" 

Please let me know how can I achieve it. I also have a large data set here.

Thank you.

Labels (5)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| eventstats values(eventID) as eventids by appID
| where match(eventids, "123") AND match(eventids,"456")
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...