Splunk Search

How to add two different soucetype

sushil_sh
Engager

Hi,

 

We are looking to join two different soucretype which is given below

1- first source type for  abc(In this soucetype it contains all server list)

 sourcetype=abc AlertName IN ("Health Service Heartbeat Failure", "Unexpected shutdown Event ID XXXX") | sort _time  | table ServerName, AlertName

     ,AlertTriggered | dedup ServerName, AlertName

     ,AlertTriggered

 

2- Second source type for  xyz(In this source type list contain only selective server i.e suport)

 

 sourcetype=xyz  StatusValue IN(blue) Company IN("Support")  | sort _time  desc | dedup ManagementGroup , ServerName  , _time  | table ManagementGroup,  ServerName, StatusValue,  _time

__________________________________________________________-

we looking for combine syntax on which we view data  like (serverName(support), Event ID includes heartbite Failure, Start time of event, End time of event).

 

I am looking for your response 

 

Thanks in advance

 

_

Labels (3)
0 Karma

jhanvidattani
Path Finder

@sushil_sh 
Using join command between both queries would look like this:

sourcetype="abc" <further_query> | join ServerName [search sourcetype="xyz" <further_query>]

 Basically, mentioned the field/s that is common for both searches. Further information about various options or behaviour of join command is available: join 

If you find my solution/debugging steps fruitful, an upvote would be appreciated.

0 Karma

sushil_sh
Engager

Hi All,

Please response from my query, waiting for your response

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...