Splunk Search

How to extract matched data from different index and different source based on the fields?

Sekhar
Explorer

Below two events 

Start event 

Index= x source= xtype | spath application | search application= x app " saved note" RCVD | rex field=" actionid"=(?<actionid>.*)", | Rex field =log " manid=(?<mandid>.*?)", | Rex field=log "bid=(?<bid>.*"     |  Rex field=  log " state=(?<state>.*" | Table _time bid,mandid,actionid,state

 

End event 

Index=y sourcetype=yytype source=y  "VALIDATION SUCESS" " msg got" | Rex field =msg " manid\:(?<mandid>.*?)", | Rex field=msg "actionid"\:(?<actionid>.*"  | Table _time manid actionid

 

Labels (1)
0 Karma

manjunathmeti
Champion

hi @Sekhar,

You can join both queries using append and stats.

index= x source= xtype | spath application | search application= x app " saved note" RCVD | rex field=" actionid"=(?<actionid>.*)", | rex field =log " manid=(?<mandid>.*?)", | rex field=log "bid=(?<bid>.*"     |  rex field=  log " state=(?<state>.*" | table _time bid,mandid,actionid,state | apppend [
index=y sourcetype=yytype source=y  "VALIDATION SUCESS" " msg got" | rex field =msg " manid\:(?<mandid>.*?)", | rex field=msg "actionid"\:(?<actionid>.*"  | table _time manid actionid ] | stats values(*) as * by mandid, actionid
0 Karma

Sekhar
Explorer

When I excute the start event  getting 40 statistics and end event result  43 statistics 

 

But when I used append and stats getting 75 statistics.

 My requirement is matching the mandid for both the events . Then I will calculate the duration from end event to start event .

How can I validate by data or query getting correct results 

   

 

 

 

 

0 Karma

manjunathmeti
Champion

Try this:

index= x source= xtype | spath application | search application= x app " saved note" RCVD | rex field=" actionid"=(?<actionid>.*)", | rex field =log " manid=(?<mandid>.*?)", | rex field=log "bid=(?<bid>.*"     |  rex field=  log " state=(?<state>.*" | eval starttime=_time | table _time,bid,mandid,actionid,state | apppend [
index=y sourcetype=yytype source=y  "VALIDATION SUCESS" " msg got" | rex field =msg " manid\:(?<mandid>.*?)", | rex field=msg "actionid"\:(?<actionid>.*"  | table _time manid actionid | eval endtime=_time ] | stats values(*) as * by mandid | eval duration=endtime-starttime
0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

 Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team for an ...

Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know

To Community SOAR App Developers - we're reaching out with an important update regarding Python 3.9's ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...