Splunk Search

How to combine two searches on different sources based on one common field value?

gsbpp
Observer

I have two different searches:

1. index=xoom_app_online_checkout_orchestration_api user_id residence_country=US request_cobrand=null 

2.  index!=xoom_app_online_checkout_orchestration_api user_id tracing_user_id tracing_user_type="ABC" 

 

From the first search, I want to retrieve user_id

From the second search, I want to retrieve tracing_user_id

I only want a response if user_id=tracing_user_id

I was using this query, but it was ignoring values from search (1):

 

( index="xoom_app_online_checkout_orchestration_api" user_id residence_country=US request_cobrand=null ) OR (index!=xoom_app_online_checkout_orchestration_api tracing_user_id tracing_user_type="ABC" )
| eval joiner=if(index="xoom_app_online_checkout_orchestration_api", user_id, tracing_user_id)| stats values(*) as * by joiner | WHERE user_id=tracing_user_id

 

Labels (2)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Something like 

( index="xoom_app_online_checkout_orchestration_api" user_id residence_country=US request_cobrand=null ) OR (index!=xoom_app_online_checkout_orchestration_api tracing_user_id tracing_user_type="ABC" )
| eval common_id = coalesce(user_id, tracing_user_id)
| eventstats values(index) as indices by common_id
| where indices == "xoom_app_online_checkout_orchestration_api" AND mvcount(indices) > 1
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Monitoring MariaDB and MySQL

In a previous post, we explored monitoring PostgreSQL and general best practices around which metrics to ...

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...