Splunk Search

How to exclude a field from one sourcetype when it appears in two joined searches

markhvesta
Path Finder

I have a search that is joining two sourcetypes that has multiple fields that have the same name. I want to join on one field that is in both, but would like to exclude some of the fields that are present in both.

(sourcetype="sourceA" OR sourcetype="sourceB" ) fieldinAandB=*   
|stats values(*) as * by fieldinAandB
| fields fieldinAandB fieldcalledsamethinginAandBButWeOnlyWantA fieldinA fieldinB

In this search, how would I exclude fieldcalledsamethinginAandBButWeOnlyWantA for B only?

Tags (1)
0 Karma
1 Solution

aberkow
Builder

I think you basically want an if clause that says "if I'm from the right sourcetype, keep my value, else overwrite me as null()". Then, when you write the stats call, you won't be picking up any of the values when you don't want them. FWIW you should also specify an index whenever possible, that's a huge performance key for Splunk.

Example below:

{code}
(sourcetype="sourceA" OR sourcetype="sourceB" ) fieldinAandB=*

| eval fieldInA=if(sourcetype="sourceA", fieldinAandB, null())
| eval fieldInB=if(sourcetype="sourceB", fieldinAandB, null())
|stats values(fieldInA) as fieldInA, values(fieldInB) as fieldInB by fieldinAandB
| fields whateverYouWant
{code}

Does that answer your question?

View solution in original post

woodcock
Esteemed Legend

Like this:

index="YouShouldAlwaysSpecifyAnIndex" AND (sourcetype="sourceA" OR sourcetype="sourceB" ) AND fieldinAandB="*"
| fields fieldinAandB and any others you would like to keep here   
| stats values(*) AS * by fieldinAandB
| fields fieldinAandB fieldcalledsamethinginAandBButWeOnlyWantA fieldinA fieldinB

aberkow
Builder

How do you get the nice table formatting for your code? 😧

0 Karma

aberkow
Builder

I think you basically want an if clause that says "if I'm from the right sourcetype, keep my value, else overwrite me as null()". Then, when you write the stats call, you won't be picking up any of the values when you don't want them. FWIW you should also specify an index whenever possible, that's a huge performance key for Splunk.

Example below:

{code}
(sourcetype="sourceA" OR sourcetype="sourceB" ) fieldinAandB=*

| eval fieldInA=if(sourcetype="sourceA", fieldinAandB, null())
| eval fieldInB=if(sourcetype="sourceB", fieldinAandB, null())
|stats values(fieldInA) as fieldInA, values(fieldInB) as fieldInB by fieldinAandB
| fields whateverYouWant
{code}

Does that answer your question?

Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...