Splunk Search

How to filter and append a value from a subsearch into the primary search?

brajaram
Communicator

My data is in JSON format split into two different sourcetypes. Between the two sourcetypes exists a linking logID that can be used to find connected events. The query I am using currently is:

index=...sourcetype=A [search index=... sourcetype=B Other Filters| table logID ]
| table field1 field2 ...

This correctly finds events in sourcetype A that meet the filters in sourcetype B. However, I need a field (uniqueID) that only exists in sourcetype B to be printed along the events in sourcetype A.

If I do

index=...sourcetype=A [search index=... sourcetype=B Other Filters| table logID uniqueID] | table field1 field2 uniqueID it doesn't work, so how do I filter and append together in one query?

Tags (3)
0 Karma
1 Solution

somesoni2
Revered Legend

Try these

index=...sourcetype=A [search index=... sourcetype=B Other Filters| table logID ] | table logID field1 field2 ...
| append [search index=... sourcetype=B Other Filters| table logID  uniqueID  ]
| stats values(*) as * by logID

OR

index=...sourcetype=A [search index=... sourcetype=B Other Filters| table logID ] | table logID field1 field2 ...| eval from=1
| append [search index=... sourcetype=B Other Filters| table logID  uniqueID  ]
| stats values(*) as * by logID | where from=1 | fields - from logID

OR

 index=.. (sourcetype=A) OR (sourcetype=B Other Filters) | fields sourcetype logID uniqueID field1 field2 .. | stats values(*) as * by logID | where mvcount(sourcetype)=2 | table field1 field2... uniqueID

View solution in original post

somesoni2
Revered Legend

Try these

index=...sourcetype=A [search index=... sourcetype=B Other Filters| table logID ] | table logID field1 field2 ...
| append [search index=... sourcetype=B Other Filters| table logID  uniqueID  ]
| stats values(*) as * by logID

OR

index=...sourcetype=A [search index=... sourcetype=B Other Filters| table logID ] | table logID field1 field2 ...| eval from=1
| append [search index=... sourcetype=B Other Filters| table logID  uniqueID  ]
| stats values(*) as * by logID | where from=1 | fields - from logID

OR

 index=.. (sourcetype=A) OR (sourcetype=B Other Filters) | fields sourcetype logID uniqueID field1 field2 .. | stats values(*) as * by logID | where mvcount(sourcetype)=2 | table field1 field2... uniqueID
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...