Splunk Search

How to extract matched data from different index and different source based on the fields?

Sekhar
Explorer

Below two events 

Start event 

Index= x source= xtype | spath application | search application= x app " saved note" RCVD | rex field=" actionid"=(?<actionid>.*)", | Rex field =log " manid=(?<mandid>.*?)", | Rex field=log "bid=(?<bid>.*"     |  Rex field=  log " state=(?<state>.*" | Table _time bid,mandid,actionid,state

 

End event 

Index=y sourcetype=yytype source=y  "VALIDATION SUCESS" " msg got" | Rex field =msg " manid\:(?<mandid>.*?)", | Rex field=msg "actionid"\:(?<actionid>.*"  | Table _time manid actionid

 

Labels (1)
0 Karma

manjunathmeti
Champion

hi @Sekhar,

You can join both queries using append and stats.

index= x source= xtype | spath application | search application= x app " saved note" RCVD | rex field=" actionid"=(?<actionid>.*)", | rex field =log " manid=(?<mandid>.*?)", | rex field=log "bid=(?<bid>.*"     |  rex field=  log " state=(?<state>.*" | table _time bid,mandid,actionid,state | apppend [
index=y sourcetype=yytype source=y  "VALIDATION SUCESS" " msg got" | rex field =msg " manid\:(?<mandid>.*?)", | rex field=msg "actionid"\:(?<actionid>.*"  | table _time manid actionid ] | stats values(*) as * by mandid, actionid
0 Karma

Sekhar
Explorer

When I excute the start event  getting 40 statistics and end event result  43 statistics 

 

But when I used append and stats getting 75 statistics.

 My requirement is matching the mandid for both the events . Then I will calculate the duration from end event to start event .

How can I validate by data or query getting correct results 

   

 

 

 

 

0 Karma

manjunathmeti
Champion

Try this:

index= x source= xtype | spath application | search application= x app " saved note" RCVD | rex field=" actionid"=(?<actionid>.*)", | rex field =log " manid=(?<mandid>.*?)", | rex field=log "bid=(?<bid>.*"     |  rex field=  log " state=(?<state>.*" | eval starttime=_time | table _time,bid,mandid,actionid,state | apppend [
index=y sourcetype=yytype source=y  "VALIDATION SUCESS" " msg got" | rex field =msg " manid\:(?<mandid>.*?)", | rex field=msg "actionid"\:(?<actionid>.*"  | table _time manid actionid | eval endtime=_time ] | stats values(*) as * by mandid | eval duration=endtime-starttime
0 Karma
Get Updates on the Splunk Community!

Index This | What’s a riddle wrapped in an enigma?

September 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

BORE at .conf25

Boss Of Regular Expression (BORE) was an interactive session run again this year at .conf25 by the brilliant ...

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...