Splunk Search

How do i extract a value from one search, use it in a second search, and then output fields from both searches

ezmo1982
Path Finder

Hi 

I need to search one index, extract a value from a field from that search, then use that value when searching a different index. I then need to join values from both searches into my output. Im guessing i need to use a subsearch or append of some kind?

First search is index=cisco_fw | stats values(action), values(user). 

Second search is index=web_proxy | stats values(url). This index also contains a field named user. I want to use the value of user from the first search and search the user field in the second search with that value. In other words,  the user field value from both search needs to match. I then need to combine the output i.e values(action) values(url) and values(user) to display all three values on one line.

Thanks. 

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Have you tried:

index=cisco_fw OR index=web_proxy | stats values(action), values(url) by user

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Have you tried:

index=cisco_fw OR index=web_proxy | stats values(action), values(url) by user

View solution in original post

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!