Splunk Search

How to filter and append a value from a subsearch into the primary search?

brajaram
Communicator

My data is in JSON format split into two different sourcetypes. Between the two sourcetypes exists a linking logID that can be used to find connected events. The query I am using currently is:

index=...sourcetype=A [search index=... sourcetype=B Other Filters| table logID ]
| table field1 field2 ...

This correctly finds events in sourcetype A that meet the filters in sourcetype B. However, I need a field (uniqueID) that only exists in sourcetype B to be printed along the events in sourcetype A.

If I do

index=...sourcetype=A [search index=... sourcetype=B Other Filters| table logID uniqueID] | table field1 field2 uniqueID it doesn't work, so how do I filter and append together in one query?

Tags (3)
0 Karma
1 Solution

somesoni2
Revered Legend

Try these

index=...sourcetype=A [search index=... sourcetype=B Other Filters| table logID ] | table logID field1 field2 ...
| append [search index=... sourcetype=B Other Filters| table logID  uniqueID  ]
| stats values(*) as * by logID

OR

index=...sourcetype=A [search index=... sourcetype=B Other Filters| table logID ] | table logID field1 field2 ...| eval from=1
| append [search index=... sourcetype=B Other Filters| table logID  uniqueID  ]
| stats values(*) as * by logID | where from=1 | fields - from logID

OR

 index=.. (sourcetype=A) OR (sourcetype=B Other Filters) | fields sourcetype logID uniqueID field1 field2 .. | stats values(*) as * by logID | where mvcount(sourcetype)=2 | table field1 field2... uniqueID

View solution in original post

somesoni2
Revered Legend

Try these

index=...sourcetype=A [search index=... sourcetype=B Other Filters| table logID ] | table logID field1 field2 ...
| append [search index=... sourcetype=B Other Filters| table logID  uniqueID  ]
| stats values(*) as * by logID

OR

index=...sourcetype=A [search index=... sourcetype=B Other Filters| table logID ] | table logID field1 field2 ...| eval from=1
| append [search index=... sourcetype=B Other Filters| table logID  uniqueID  ]
| stats values(*) as * by logID | where from=1 | fields - from logID

OR

 index=.. (sourcetype=A) OR (sourcetype=B Other Filters) | fields sourcetype logID uniqueID field1 field2 .. | stats values(*) as * by logID | where mvcount(sourcetype)=2 | table field1 field2... uniqueID

View solution in original post

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!