Splunk Search

How to co-relate data from multiple sourcetypes?


I have data in three source types to co-relate. Time and a unique identifier number are common for all three sourcetype data.

Sample data from the first sourcetype:

_time         unique_number Name
12/9/2019 9:49  4782     John
12/9/2019 9:52  698   Andrew
12/9/2019 9:56  2487     Marshal

I need to check whether John is having a unique number 4782 in the rest of the two tables within the last 20 minutes of 1st sourcetype data time aka John's time (i.e.: 12/9/2019 9:49).
If any match found, need to return a comment(matched/not matched) to main search (i.e.: table _time,unique_number,Name,comment.
I tried sub search with join but definitely missing some points and not getting the desired output.

0 Karma

Ultra Champion
| makeresults 
| eval _raw="_time,unique_number,Name
12/9/2019 9:49,4782,John
12/9/2019 9:52,698,Andrew
12/9/2019 9:56,2487,Marshal" 
| multikv forceheader=1 
| eval _time=strptime(time,"%m/%d/%Y %H:%M") 
| table _time,unique_number,Name 
| rename COMMENT AS "this is sample you provide"
| rename COMMENT AS "From here, the logic"
| eventstats range(_time) as time_check
| eval comment=if(Name="John" AND unique_number=4782 AND time_check <= 60 * 20,"matched","not matched")
| table _time,unique_number,Name,comment

Hi, @ahmadshakir1952
I don't understand subsearch well, but I think we can create a query if you provide us with the conditions.

Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...