Splunk Search

How can I search across two sourcetypes for matching fields and output a table with matching results?

vkrishnachand
New Member

Hi

I have one index with two sourcetypes: S1 and S2. In sourcetype S1 I have fields A, B, C and in sourcetype S2 I have fields D, E, F.

The values in B field will sometimes be equal to values in E field, where if they are equal my final output should be in form of table with fields A,B,C,D,E,F.

Please help on the same.

0 Karma

vkrishnachand
New Member

Hi

thanks for this. I should display the result in a table something like a table with all the fields combined to gether something like table A B C D E F. how to do this.

0 Karma

jplumsdaine22
Influencer

If B & E are unique identifiers that are the same, you could do something like this:

index=A (sourcetype=S1 OR sourcetype=S2) 
| eval G=coalesce(B,E) 
| stats values(A) as A values(C) as C values(D) as D values(F) as F by G

vkrishnachand
New Member

Hi

thanks for this. I should display the result in a table something like a table with all the fields combined to gether something like table A B C D E F. how to do this.

0 Karma

jplumsdaine22
Influencer

That search should do it. You can rearrange the fields like this if you want:

 | fields A G C D F

(don't forget we made G the value of B or E)

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...