Splunk Search

How can I search across two sourcetypes for matching fields and output a table with matching results?

vkrishnachand
New Member

Hi

I have one index with two sourcetypes: S1 and S2. In sourcetype S1 I have fields A, B, C and in sourcetype S2 I have fields D, E, F.

The values in B field will sometimes be equal to values in E field, where if they are equal my final output should be in form of table with fields A,B,C,D,E,F.

Please help on the same.

0 Karma

vkrishnachand
New Member

Hi

thanks for this. I should display the result in a table something like a table with all the fields combined to gether something like table A B C D E F. how to do this.

0 Karma

jplumsdaine22
Influencer

If B & E are unique identifiers that are the same, you could do something like this:

index=A (sourcetype=S1 OR sourcetype=S2) 
| eval G=coalesce(B,E) 
| stats values(A) as A values(C) as C values(D) as D values(F) as F by G

vkrishnachand
New Member

Hi

thanks for this. I should display the result in a table something like a table with all the fields combined to gether something like table A B C D E F. how to do this.

0 Karma

jplumsdaine22
Influencer

That search should do it. You can rearrange the fields like this if you want:

 | fields A G C D F

(don't forget we made G the value of B or E)

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...