Splunk Search

How to filter and append a value from a subsearch into the primary search?

brajaram
Communicator

My data is in JSON format split into two different sourcetypes. Between the two sourcetypes exists a linking logID that can be used to find connected events. The query I am using currently is:

index=...sourcetype=A [search index=... sourcetype=B Other Filters| table logID ]
| table field1 field2 ...

This correctly finds events in sourcetype A that meet the filters in sourcetype B. However, I need a field (uniqueID) that only exists in sourcetype B to be printed along the events in sourcetype A.

If I do

index=...sourcetype=A [search index=... sourcetype=B Other Filters| table logID uniqueID] | table field1 field2 uniqueID it doesn't work, so how do I filter and append together in one query?

Tags (3)
0 Karma
1 Solution

somesoni2
Revered Legend

Try these

index=...sourcetype=A [search index=... sourcetype=B Other Filters| table logID ] | table logID field1 field2 ...
| append [search index=... sourcetype=B Other Filters| table logID  uniqueID  ]
| stats values(*) as * by logID

OR

index=...sourcetype=A [search index=... sourcetype=B Other Filters| table logID ] | table logID field1 field2 ...| eval from=1
| append [search index=... sourcetype=B Other Filters| table logID  uniqueID  ]
| stats values(*) as * by logID | where from=1 | fields - from logID

OR

 index=.. (sourcetype=A) OR (sourcetype=B Other Filters) | fields sourcetype logID uniqueID field1 field2 .. | stats values(*) as * by logID | where mvcount(sourcetype)=2 | table field1 field2... uniqueID

View solution in original post

somesoni2
Revered Legend

Try these

index=...sourcetype=A [search index=... sourcetype=B Other Filters| table logID ] | table logID field1 field2 ...
| append [search index=... sourcetype=B Other Filters| table logID  uniqueID  ]
| stats values(*) as * by logID

OR

index=...sourcetype=A [search index=... sourcetype=B Other Filters| table logID ] | table logID field1 field2 ...| eval from=1
| append [search index=... sourcetype=B Other Filters| table logID  uniqueID  ]
| stats values(*) as * by logID | where from=1 | fields - from logID

OR

 index=.. (sourcetype=A) OR (sourcetype=B Other Filters) | fields sourcetype logID uniqueID field1 field2 .. | stats values(*) as * by logID | where mvcount(sourcetype)=2 | table field1 field2... uniqueID
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...