Splunk Search

How to Match event between two Index and get desired value

ashiknew007
New Member

Hi,

I am trying to match events between two index: Index A & Index B.
Index A have 3 column: date-time, User's Cell NO, user's account type and the agent name who modify that user's information.
Index B have 3 column: date-time, User's Cell NO, user's account type and the agent name who modify that user's information.

Both the data is different sources and different values, date-time.

My expectation is to match the user's cell no between two index based on below criteria:
1)_ If any "cell no" exist in "Index A" will match with "Index B" only 10min before of the Index A time. I tried below command which is not as expected result:_

index=A | join CellNO type=outer usetime=true earlier=true [search index=B earliest=-10m latest=now
| fields _time,CellNo,Agent,TIME-B]
| fillnull value="Not found"
| table _time(A),CellNo,TIME-B,Agent

2) If any CellNo exist in Index-A but not exist in Index-B (just 10min before of the Index-A time), then i want to see the "agent name" from Index-A

Can anyone please help on this to share the commands.

0 Karma

ashiknew007
New Member

Hi gcusello,
many thanks for your feedback. here is feedback for your query:
1) Yes, correct. It is "CellNo"
2) Actually I want to mean here the time of Index-A with this "_time(A)"
3) with the word TIME-A & TIME-B, actually I mean here the value from Index-A and Index-B respectively.
I tried with "join type=inner" which shows me the value from all time and not only the 10m before data.
I will try ur command and get back to you.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi ashiknew007,
Only few adding information:

  • "CellNO" is a writing error, the correct one is CellNo, correct? Fieldnames are case sensitive!
  • What's "_time(A)", there isn't any field with this name?
  • if you use type=outher in Join, the most values haven't TIME-B field, is it correct?

Anyway, try something like this:

index=A | join CellNo type=outer usetime=true earlier=true [search index=B earliest=-10m latest=now
| rename Agent AS AgentB
| fields _time,CellNo,AgentB,TIME-B]
| eval Agent=coalesce(AgentB,Agent)
| fillnull value="Not found" 
| table _time, CellNo, TIME-B, Agent

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...