Splunk Search

How to join two log files in Splunk

alenseb
Communicator

Hi all,

I have to two sourcetypes(NetSweep_log & Radius_log), both of them have a common field called "FramedIP". How can i extract the rows which have this common field ??

Please help.
Thanks!!

Tags (4)
0 Karma
1 Solution

MHibbin
Influencer

So basically you will need to (and sorry if there is some repetition to what you have done, question is a little unclear) is...

Extract the fields for each sourcetype, with the easiest way being the IFX (Interactive Field eXtractor), alternatively using conf files.

Search those sourcetypes and you should have that field available in your Field Discovery panel (on the left). e.g....

(Soucetype=NetSweep_log OR sourcetype=Radius_log) | top FramedIP

Shoule be simple enough.

Hope this helps, if it doesn't please explain a little more

MHibbin

View solution in original post

0 Karma

MHibbin
Influencer

So basically you will need to (and sorry if there is some repetition to what you have done, question is a little unclear) is...

Extract the fields for each sourcetype, with the easiest way being the IFX (Interactive Field eXtractor), alternatively using conf files.

Search those sourcetypes and you should have that field available in your Field Discovery panel (on the left). e.g....

(Soucetype=NetSweep_log OR sourcetype=Radius_log) | top FramedIP

Shoule be simple enough.

Hope this helps, if it doesn't please explain a little more

MHibbin

View solution in original post

0 Karma

alenseb
Communicator

I tried this command, but it returns "0 matching events".
The logic seems to be correct though.
Is there any syntax we are missing?

0 Karma

MHibbin
Influencer

If this answers your question please mark it as accepted (with the tick next to the answer), and if you are feeling generous you can also up-vote it. Thanks 🙂

0 Karma

MHibbin
Influencer

So you want to use the values from the FramedIP field from the NetSweep_Log and use it search in the Radius Logs?

In that case you will need to use the subsearch feature, this will involve:

  1. Define you base search to gather field values (e.g. sourcetype=NetSweep_Log | top FramedIP)
  2. Append this to your main search, where you look at the Radius_log (e.g. sourcetype=Radius_log [search sourcetype=NetSweep_Log | top FramedIP | fields + FramedIP])

I'm assuming this is what you after. You should read docs here... http://docs.splunk.com/Documentation/Splunk/4.3.3/User/HowSubsearchesWork

alenseb
Communicator

I guess this shows all the FramedIP from both the sourcetype.
But what i really need is All the data available in NetSweep_Log for FramedIP present in Radius_log.

I am new to Splunk. Sorry if its a stupid question.

Thanks!!

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!