Splunk Search

How to Match event between two Index and get desired value

ashiknew007
New Member

Hi,

I am trying to match events between two index: Index A & Index B.
Index A have 3 column: date-time, User's Cell NO, user's account type and the agent name who modify that user's information.
Index B have 3 column: date-time, User's Cell NO, user's account type and the agent name who modify that user's information.

Both the data is different sources and different values, date-time.

My expectation is to match the user's cell no between two index based on below criteria:
1)_ If any "cell no" exist in "Index A" will match with "Index B" only 10min before of the Index A time. I tried below command which is not as expected result:_

index=A | join CellNO type=outer usetime=true earlier=true [search index=B earliest=-10m latest=now
| fields _time,CellNo,Agent,TIME-B]
| fillnull value="Not found"
| table _time(A),CellNo,TIME-B,Agent

2) If any CellNo exist in Index-A but not exist in Index-B (just 10min before of the Index-A time), then i want to see the "agent name" from Index-A

Can anyone please help on this to share the commands.

0 Karma

ashiknew007
New Member

Hi gcusello,
many thanks for your feedback. here is feedback for your query:
1) Yes, correct. It is "CellNo"
2) Actually I want to mean here the time of Index-A with this "_time(A)"
3) with the word TIME-A & TIME-B, actually I mean here the value from Index-A and Index-B respectively.
I tried with "join type=inner" which shows me the value from all time and not only the 10m before data.
I will try ur command and get back to you.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi ashiknew007,
Only few adding information:

  • "CellNO" is a writing error, the correct one is CellNo, correct? Fieldnames are case sensitive!
  • What's "_time(A)", there isn't any field with this name?
  • if you use type=outher in Join, the most values haven't TIME-B field, is it correct?

Anyway, try something like this:

index=A | join CellNo type=outer usetime=true earlier=true [search index=B earliest=-10m latest=now
| rename Agent AS AgentB
| fields _time,CellNo,AgentB,TIME-B]
| eval Agent=coalesce(AgentB,Agent)
| fillnull value="Not found" 
| table _time, CellNo, TIME-B, Agent

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...