Splunk Search

How do you combine data from two source types based on common values?

dminev1
Explorer

Hi there,

I have a question regarding source types. I have 2 source types "A" and "B". "A" has a field called "aaa" and "B" has field call "bbb". These two fields share the same value ( example: aaa=123, bbb=123) but the field name is different. I want to combine the two source types based on the fields with the same value(the value will change dynamically so I can't hardcode it) and extract data from both source types.

Is it possible and if it is, how would I approach this?

I tried something like this:

index=???  host=??? (sourcetype=A OR sourcetype=B) 
| rename aaa as bbb
| rex field=_raw "ClientId=(?\d+)"
| stats values(cID) as ID by bbb
| eval Duration = round(Duration,3)
| tab
0 Karma
1 Solution

somesoni2
Revered Legend

Try something like this

index=???  host=??? (sourcetype=A OR sourcetype=B) 
 | eval commonfield=coalesce(aaa,bbb)
 | rex field=_raw "ClientId=(?<cID>\d+)"
 | stats values(cID) as ID values(Duration) as Duration by commonfield
 | eval Duration = round(Duration,3)

View solution in original post

0 Karma

somesoni2
Revered Legend

Try something like this

index=???  host=??? (sourcetype=A OR sourcetype=B) 
 | eval commonfield=coalesce(aaa,bbb)
 | rex field=_raw "ClientId=(?<cID>\d+)"
 | stats values(cID) as ID values(Duration) as Duration by commonfield
 | eval Duration = round(Duration,3)
0 Karma

dminev1
Explorer

It worked. Thank you for the quick response.

0 Karma
Get Updates on the Splunk Community!

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...