Splunk Search

How to create new field with values from a search that uses values of current field?

buttsurfer
Path Finder

I have a search that outputs a table like below

 

         user  |  host  |  app
-------------------------------------

        user1 | host1 | app1

 

I want to add a new field that that finds the Department of the user from another search. So it would look like this 

 

     dep  |  user  |  host  |  app
-------------------------------------

    dep1 |  user1 | host1 | app1

 

 

The second search will have something like this in it so i don't think a join would be sufficient 

 

where match(search,"something\s+user")

 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @buttsurfer,

in other words: you want to make a join between two searches.

In Splunk there's the "join" command but it must be used only if there isn't any other solution, so you could try this approach:

(index=index1) OR (index=index2)
| stats 
   values(dep) AS dep 
   values(host) AS host 
   values(app) AS app 
   dc(index) AS index_count
   BY user
| where index_count=2
| table dep user host app

Ciao.

Giuseppe

0 Karma

buttsurfer
Path Finder

Hi Giuseppe, thanks for the reply. But how would the second search get the value (user) of the first search's result in order to find its department?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @buttsurfer,

in this way you correlate:

  • user,  host and  app from the first search
  • dep and user from the second search

using user as correlation key

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...