Splunk Search

How to combine two searches on different sources based on one common field value?

gsbpp
Explorer

I have two different searches:

1. index=xoom_app_online_checkout_orchestration_api user_id residence_country=US request_cobrand=null 

2.  index!=xoom_app_online_checkout_orchestration_api user_id tracing_user_id tracing_user_type="ABC" 

 

From the first search, I want to retrieve user_id

From the second search, I want to retrieve tracing_user_id

I only want a response if user_id=tracing_user_id

I was using this query, but it was ignoring values from search (1):

 

( index="xoom_app_online_checkout_orchestration_api" user_id residence_country=US request_cobrand=null ) OR (index!=xoom_app_online_checkout_orchestration_api tracing_user_id tracing_user_type="ABC" )
| eval joiner=if(index="xoom_app_online_checkout_orchestration_api", user_id, tracing_user_id)| stats values(*) as * by joiner | WHERE user_id=tracing_user_id

 

Labels (2)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Something like 

( index="xoom_app_online_checkout_orchestration_api" user_id residence_country=US request_cobrand=null ) OR (index!=xoom_app_online_checkout_orchestration_api tracing_user_id tracing_user_type="ABC" )
| eval common_id = coalesce(user_id, tracing_user_id)
| eventstats values(index) as indices by common_id
| where indices == "xoom_app_online_checkout_orchestration_api" AND mvcount(indices) > 1
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...