Splunk Search

How do I match events from two different sources based on a common field found in both?



I have 2 fields resp_time and response_time in two different sources. Lets call it source1 and source2. In both of these sources, there is a field, let's call it artifact, that I want to use to match up these response times in a table. I have looked around, but nothing is matching up for me. I was wondering the best approach for this. I was thinking using a subsearch inside my main search to find the artifact in source1 and then use that value to find the event in source2 and match the response times. Is there an easier way?

Tags (3)
0 Karma

Revered Legend

Try something like this

(index=A source=source1) OR (index=B source=source2) | eval response_time=coalesce(response_time, resp_time) | stats values(response_time) over artifact by source

A column need might be required to rename source to something more user friendly name.

0 Karma
Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...