Splunk Search

How do I combine 3 searches?

New Member

I have search1 which is a join of 2 different log sources ( S1 , S2 ). After joining these sources, I used rex to extract one specific field like field1 ( I had to combine two sources as this gave me all the data I needed ) .

index=sthng  sourcetype=source S1  some condition Y  | join common filed  [ search sourcetype=Source S2 LogType= *| fields - to be excluded ] | rex field=field extracted f1   | stats  values(*)  | eval condition resulting in field Z  | search z > 10

I have another search which has results from another source (S3). I again used rex to extract one specific field, like field 2, in this search.

index=same as above search  sourcetype=S3  some condition C  | rex field= field extracted f2.

Now, I want to compare both these searches based on field1 , field2 — like, compare field1 and field2 from the results of both the searches, and if at the same time ( or around the same time ) , field1 is not equal to field 2, it would show me the results.

0 Karma
Get Updates on the Splunk Community!

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...