Splunk Search

How to create new field with values from a search that uses values of current field?

buttsurfer
Path Finder

I have a search that outputs a table like below

 

         user  |  host  |  app
-------------------------------------

        user1 | host1 | app1

 

I want to add a new field that that finds the Department of the user from another search. So it would look like this 

 

     dep  |  user  |  host  |  app
-------------------------------------

    dep1 |  user1 | host1 | app1

 

 

The second search will have something like this in it so i don't think a join would be sufficient 

 

where match(search,"something\s+user")

 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @buttsurfer,

in other words: you want to make a join between two searches.

In Splunk there's the "join" command but it must be used only if there isn't any other solution, so you could try this approach:

(index=index1) OR (index=index2)
| stats 
   values(dep) AS dep 
   values(host) AS host 
   values(app) AS app 
   dc(index) AS index_count
   BY user
| where index_count=2
| table dep user host app

Ciao.

Giuseppe

0 Karma

buttsurfer
Path Finder

Hi Giuseppe, thanks for the reply. But how would the second search get the value (user) of the first search's result in order to find its department?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @buttsurfer,

in this way you correlate:

  • user,  host and  app from the first search
  • dep and user from the second search

using user as correlation key

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...