Splunk Search

How to combine two searches on different sources based on one common field value?

gsbpp
Observer

I have two different searches:

1. index=xoom_app_online_checkout_orchestration_api user_id residence_country=US request_cobrand=null 

2.  index!=xoom_app_online_checkout_orchestration_api user_id tracing_user_id tracing_user_type="ABC" 

 

From the first search, I want to retrieve user_id

From the second search, I want to retrieve tracing_user_id

I only want a response if user_id=tracing_user_id

I was using this query, but it was ignoring values from search (1):

 

( index="xoom_app_online_checkout_orchestration_api" user_id residence_country=US request_cobrand=null ) OR (index!=xoom_app_online_checkout_orchestration_api tracing_user_id tracing_user_type="ABC" )
| eval joiner=if(index="xoom_app_online_checkout_orchestration_api", user_id, tracing_user_id)| stats values(*) as * by joiner | WHERE user_id=tracing_user_id

 

Labels (2)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Something like 

( index="xoom_app_online_checkout_orchestration_api" user_id residence_country=US request_cobrand=null ) OR (index!=xoom_app_online_checkout_orchestration_api tracing_user_id tracing_user_type="ABC" )
| eval common_id = coalesce(user_id, tracing_user_id)
| eventstats values(index) as indices by common_id
| where indices == "xoom_app_online_checkout_orchestration_api" AND mvcount(indices) > 1
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...