I want to get the combined result of two events. E.g The first event have reference ID, Name & IP and the second event contains Email ID & reference ID. So here I need to get the combined result of first and second events. i.e., It would be like "Reference ID, Name, IP & Email". Is there any possibility to join both event values?
I have to get these results with 2 searches as below
sourcetype="" "Name" AND "IP address" referenceId!="" | Table referenceId
index="" referenceId AND Email
You can use join, transaction, or simply stats to obtain this.
Join: http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/Join
Example:
index=a source=abc ... | join referenceid [search index=b source=xyz ....]
Transaction: http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/Transaction
Example:
index=abc sourcetype=access_* | transaction referenceid maxspan=30s maxpause=5s
Stats: https://answers.splunk.com/answers/204782/how-to-join-two-search-events-that-have-a-common-f.html
Example:
A OR B OR C | stats values(Name) as Name, values(IP) as IP,values(Email) as Email by referenceid
Also refer to
http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/Commandsbycategory
You can use join, transaction, or simply stats to obtain this.
Join: http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/Join
Example:
index=a source=abc ... | join referenceid [search index=b source=xyz ....]
Transaction: http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/Transaction
Example:
index=abc sourcetype=access_* | transaction referenceid maxspan=30s maxpause=5s
Stats: https://answers.splunk.com/answers/204782/how-to-join-two-search-events-that-have-a-common-f.html
Example:
A OR B OR C | stats values(Name) as Name, values(IP) as IP,values(Email) as Email by referenceid
Also refer to
http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/Commandsbycategory