Splunk Search

How to Combine Events with matching data

BlueWombat45
New Member

Hi, I have a union'ed search where I am wanting to link different events based on fields that have matching values.
My search looks like this:
| union
[search message=*
| spath Field1
| spath Field2]
[search city=*
| spath FieldA 
| spath FieldB]
| table Field1 Field2 FieldA FieldB

My current output looks like this:

Field1Field2FieldAFieldB
JohnBlue  
  BlueOhio
  YellowWyoming

 

However I need a way to link Field1 to FieldB if Field2=FieldA, where the output would look something like this: 

Field1Field2FieldAFieldB
JohnBlueBlueOhio
  YellowWyoming


If there is a way to do something like this, please let me know, even if I need to create new fields. The excess FieldA and FieldB are unimportant if there is not a matching Field2. 

please help, please

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
message=* OR city=*
| eval Field2=coalesce(Field2, FieldA)
| stats values(*) as * by Field2
| where isnotnul(Field1)
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...