Splunk Search

How do I find common values in result of two queries on same source and field?

user9025
Path Finder

I have two queries: 

1. index=A sourcetype=B  "ERROR_A" | rex field=_raw "loginid (?<login_id>\d+) ::" | deduploginid | tableloginid

o/p eg::

123

456

789

 

2. index=A sourcetype=B  "ERROR_B" | rex field=_raw "loginid (?<login_id>\d+) ::" | dedup loginid | table loginid

o/p eg::

878

123

456

Query 1 finds all the login ID which failed because of ERROR_A and Query 2 finds all the login ID which failed because of ERROR_B. I want to find all the loginId which failed because of both ERROR_A and ERROR_B.SO expected result from above is

123

456

How can I combine both these queries given the the loginid is a extract field from raw logs.?

Labels (4)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
index=A sourcetype=B "ERROR_A" OR "ERROR_B" 
| rex "(?<errortype>ERROR_A|ERROR_B)"
| rex field=_raw "loginid (?<login_id>\d+) ::" 
| stats count by login_id errortype
| stats count by login_id
| where count = 2

View solution in original post

somesoni2
Revered Legend

Give this a try

index=A sourcetype=B  "ERROR_A" OR "ERROR_B"
| rex field=_raw "loginid (?<login_id>\d+) ::" 
| eval Error=if(searchmatch("ERROR_A"), "ERROR_A" ,"ERROR_B" )
| stats dc(Error) as Errors by loginid | where Errors=2
| tableloginid
0 Karma

user9025
Path Finder

I will try and update. May I know that in the expression : 

| eval Error=if(searchmatch("ERROR_A"), "ERROR_A" ,"ERROR_B" )

 

Why have we put only ERROR_A in searchmatch clause ?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=A sourcetype=B "ERROR_A" OR "ERROR_B" 
| rex "(?<errortype>ERROR_A|ERROR_B)"
| rex field=_raw "loginid (?<login_id>\d+) ::" 
| stats count by login_id errortype
| stats count by login_id
| where count = 2

user9025
Path Finder

Testing.Will update once i ran this.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...