Splunk Search

How do get the combined search result?

kamaleshwar
Explorer

I want to get the combined result of two events. E.g The first event have reference ID, Name & IP and the second event contains Email ID & reference ID. So here I need to get the combined result of first and second events. i.e., It would be like "Reference ID, Name, IP & Email". Is there any possibility to join both event values?

I have to get these results with 2 searches as below

sourcetype="" "Name" AND "IP address" referenceId!="" | Table referenceId

index="" referenceId AND Email
Tags (3)
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

You can use join, transaction, or simply stats to obtain this.

Join: http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/Join
Example:

index=a source=abc ... | join referenceid [search index=b source=xyz ....]

Transaction: http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/Transaction
Example:

index=abc sourcetype=access_* | transaction referenceid maxspan=30s maxpause=5s

Stats: https://answers.splunk.com/answers/204782/how-to-join-two-search-events-that-have-a-common-f.html
Example:

A OR B OR C | stats values(Name) as Name, values(IP) as IP,values(Email) as Email  by referenceid

Also refer to
http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/Commandsbycategory

Happy Splunking!

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

You can use join, transaction, or simply stats to obtain this.

Join: http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/Join
Example:

index=a source=abc ... | join referenceid [search index=b source=xyz ....]

Transaction: http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/Transaction
Example:

index=abc sourcetype=access_* | transaction referenceid maxspan=30s maxpause=5s

Stats: https://answers.splunk.com/answers/204782/how-to-join-two-search-events-that-have-a-common-f.html
Example:

A OR B OR C | stats values(Name) as Name, values(IP) as IP,values(Email) as Email  by referenceid

Also refer to
http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/Commandsbycategory

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...