Splunk Search

How to Match event between two Index and get desired value

ashiknew007
New Member

Hi,

I am trying to match events between two index: Index A & Index B.
Index A have 3 column: date-time, User's Cell NO, user's account type and the agent name who modify that user's information.
Index B have 3 column: date-time, User's Cell NO, user's account type and the agent name who modify that user's information.

Both the data is different sources and different values, date-time.

My expectation is to match the user's cell no between two index based on below criteria:
1)_ If any "cell no" exist in "Index A" will match with "Index B" only 10min before of the Index A time. I tried below command which is not as expected result:_

index=A | join CellNO type=outer usetime=true earlier=true [search index=B earliest=-10m latest=now
| fields _time,CellNo,Agent,TIME-B]
| fillnull value="Not found"
| table _time(A),CellNo,TIME-B,Agent

2) If any CellNo exist in Index-A but not exist in Index-B (just 10min before of the Index-A time), then i want to see the "agent name" from Index-A

Can anyone please help on this to share the commands.

0 Karma

ashiknew007
New Member

Hi gcusello,
many thanks for your feedback. here is feedback for your query:
1) Yes, correct. It is "CellNo"
2) Actually I want to mean here the time of Index-A with this "_time(A)"
3) with the word TIME-A & TIME-B, actually I mean here the value from Index-A and Index-B respectively.
I tried with "join type=inner" which shows me the value from all time and not only the 10m before data.
I will try ur command and get back to you.

0 Karma

gcusello
Esteemed Legend

Hi ashiknew007,
Only few adding information:

  • "CellNO" is a writing error, the correct one is CellNo, correct? Fieldnames are case sensitive!
  • What's "_time(A)", there isn't any field with this name?
  • if you use type=outher in Join, the most values haven't TIME-B field, is it correct?

Anyway, try something like this:

index=A | join CellNo type=outer usetime=true earlier=true [search index=B earliest=-10m latest=now
| rename Agent AS AgentB
| fields _time,CellNo,AgentB,TIME-B]
| eval Agent=coalesce(AgentB,Agent)
| fillnull value="Not found" 
| table _time, CellNo, TIME-B, Agent

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...