Splunk Search

How to combine two searches on different sources based on one common field value?

gsbpp
Observer

I have two different searches:

1. index=xoom_app_online_checkout_orchestration_api user_id residence_country=US request_cobrand=null 

2.  index!=xoom_app_online_checkout_orchestration_api user_id tracing_user_id tracing_user_type="ABC" 

 

From the first search, I want to retrieve user_id

From the second search, I want to retrieve tracing_user_id

I only want a response if user_id=tracing_user_id

I was using this query, but it was ignoring values from search (1):

 

( index="xoom_app_online_checkout_orchestration_api" user_id residence_country=US request_cobrand=null ) OR (index!=xoom_app_online_checkout_orchestration_api tracing_user_id tracing_user_type="ABC" )
| eval joiner=if(index="xoom_app_online_checkout_orchestration_api", user_id, tracing_user_id)| stats values(*) as * by joiner | WHERE user_id=tracing_user_id

 

Labels (2)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Something like 

( index="xoom_app_online_checkout_orchestration_api" user_id residence_country=US request_cobrand=null ) OR (index!=xoom_app_online_checkout_orchestration_api tracing_user_id tracing_user_type="ABC" )
| eval common_id = coalesce(user_id, tracing_user_id)
| eventstats values(index) as indices by common_id
| where indices == "xoom_app_online_checkout_orchestration_api" AND mvcount(indices) > 1
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...

Cloud Platform & Enterprise: Classic Dashboard Export Feature Deprecation

As of Splunk Cloud Platform 9.3.2408 and Splunk Enterprise 9.4, classic dashboard export features are now ...

Explore the Latest Educational Offerings from Splunk (November Releases)

At Splunk Education, we are committed to providing a robust learning experience for all users, regardless of ...