Splunk Search

How to filter and append a value from a subsearch into the primary search?

Communicator

My data is in JSON format split into two different sourcetypes. Between the two sourcetypes exists a linking logID that can be used to find connected events. The query I am using currently is:

index=...sourcetype=A [search index=... sourcetype=B Other Filters| table logID ]
| table field1 field2 ...

This correctly finds events in sourcetype A that meet the filters in sourcetype B. However, I need a field (uniqueID) that only exists in sourcetype B to be printed along the events in sourcetype A.

If I do

index=...sourcetype=A [search index=... sourcetype=B Other Filters| table logID uniqueID] | table field1 field2 uniqueID it doesn't work, so how do I filter and append together in one query?

Tags (3)
0 Karma
1 Solution

Revered Legend

Try these

index=...sourcetype=A [search index=... sourcetype=B Other Filters| table logID ] | table logID field1 field2 ...
| append [search index=... sourcetype=B Other Filters| table logID  uniqueID  ]
| stats values(*) as * by logID

OR

index=...sourcetype=A [search index=... sourcetype=B Other Filters| table logID ] | table logID field1 field2 ...| eval from=1
| append [search index=... sourcetype=B Other Filters| table logID  uniqueID  ]
| stats values(*) as * by logID | where from=1 | fields - from logID

OR

 index=.. (sourcetype=A) OR (sourcetype=B Other Filters) | fields sourcetype logID uniqueID field1 field2 .. | stats values(*) as * by logID | where mvcount(sourcetype)=2 | table field1 field2... uniqueID

View solution in original post

Revered Legend

Try these

index=...sourcetype=A [search index=... sourcetype=B Other Filters| table logID ] | table logID field1 field2 ...
| append [search index=... sourcetype=B Other Filters| table logID  uniqueID  ]
| stats values(*) as * by logID

OR

index=...sourcetype=A [search index=... sourcetype=B Other Filters| table logID ] | table logID field1 field2 ...| eval from=1
| append [search index=... sourcetype=B Other Filters| table logID  uniqueID  ]
| stats values(*) as * by logID | where from=1 | fields - from logID

OR

 index=.. (sourcetype=A) OR (sourcetype=B Other Filters) | fields sourcetype logID uniqueID field1 field2 .. | stats values(*) as * by logID | where mvcount(sourcetype)=2 | table field1 field2... uniqueID

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!