Splunk Search

How to connect consumers and providers based on ID between logs and display their server names too?

ana
Engager

I am hoping you could help me out with this query, as I am quite stuck.

I want to be able to retrieve the name of the server that acts as a provider and the name of the server that acts as a consumer.  The way you could check this is a log has a ConsumerId that equals the ID of the other server. For instance, here are two logs:

ServerName="Server1", ID="1", IDConsumer=null

ServerName="Server2", ID="2" , IDConsumer="1"

 And what I want to retrieve is a table like this:

To              From         IDConsumer   IDProvider

Server1  Server2    1                          2

 

Appreciate a lot!

Labels (4)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| eval To=if(isnull(IDConsumer),ServerName,null())
| eval From=if(isnull(IDConsumer),null(),ServerName)
| eval Consumes=if(isnull(IDConsumer),ID,IDConsumer)
| eval IDProvider=if(isnull(IDConsumer),null(),ID)
| stats values(To) as To values(From) as From values(IDConsumer) as IDConsumer values(IDProvider) as IDProvider by Consumes

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval To=if(isnull(IDConsumer),ServerName,null())
| eval From=if(isnull(IDConsumer),null(),ServerName)
| eval Consumes=if(isnull(IDConsumer),ID,IDConsumer)
| eval IDProvider=if(isnull(IDConsumer),null(),ID)
| stats values(To) as To values(From) as From values(IDConsumer) as IDConsumer values(IDProvider) as IDProvider by Consumes
0 Karma

ana
Engager

Thank you!

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...