Splunk Search

How to find items from one index across other index's.

SMM10
Explorer

We have specific ID's that track how request process through the system. What I want to do search for all these ID's in one index and then join all other index's to see how these funnel down. So essentially track how a request tracks through our system, and then get all the service requests associated. I was thinking something like: 

 

index=foo
|fields service, ID
| join ID [index=*]
| stats service

 

Labels (2)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

At the most basic, if you go for join, then your existing SPL should look something like this

index=foo
| stats count by service ID 
[ 
  | join ID [index!=foo]
  | stats values(service) by ID
]

but join is never a great option - it is slow and has limitations in the number of results that can be handled by the subsearch - and the solution is not to increase the limit.

As @PickleRick says, it is better to run stats across the data set you want to search and then perform stats and test operations on the results.

The question is: What do you want to do having found the correlated services - is there any other data you want to use following the initial search, if so that will dictate how your search will look.

 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

If all your events in question had the ID field you could do something like (rough idea)

index=* ID=* | stats values(_raw) by ID

But that would mean doing stats  across all your indexes which is not very effective to say the least.

But your join would be even worse :winking_face:

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...