Splunk Search

How can i Search field from two different file source and merge in to a single table ?

JIthesh_Kumar
Explorer

Bellow mentioned table is an example which having same index and sourcetype, but it have a different source. 

I need to search a field from 1st file and the result should be a combination of fields from file 1 and 2.

File 1

 T1_Fld 1 T1_Fld 2Domain T1_Fld 4 T1_Fld 5
AAAxxxgoogle.comyy1bbb
AABxxxFacebook.comyy2bbb
AABxxxGmail.comyy3bbb
AADxxxYahoo.comyy4bbb
AAExxxxxx.comyy5bbb

 

File 2

DomainIP
google.com1.1.1.1
Facebook.com2.2.2.2
Gmail.com3.3.3.3
Yahoo.com4.4.4.4
xxx.com5.5.5.5

 

consider i am running a search where  T1_Fld 1=AAB then the result table form should be like below. 

Output

 T1_Fld 1DomainIP T1_Fld 4
AABFacebook.com2.2.2.2yy2
AABGmail.com3.3.3.3yy3

 

 

Labels (5)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Use stats to combine them

index=data_set1 OR index=data_set2
| stats values(*) as * by Domain

Here uses values(*) as * to collect all fields from both data sources against their common field Domain.

You can filter then what you do or don't want, e.g. after the above, do  

| where T1_Fld 1="AAB"

 

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Index This | What travels the world but is also stuck in place?

April 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Realizing the full potential of your Splunk investment requires more than just understanding current usage; it ...

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

As data volumes continue to grow and environments become more distributed, managing and optimizing data ...