Splunk Search

How to make table from two queries with common field

edrivera3
Builder

Hi

I have one index with two sources (source=source1 and source2). Both events have two common fields (common_field1 and common_field2).

The events with source_1 have three fields (source1_field1, common_field1, common_field2).

The events with source_2 have three fields (source2_field1, common_field1, common_field2).

I tried the following without success:

(source=source1 OR source=source2) | table common_field1, common_field2, source1_field1, source2_field1

There are more events in source1 than in source2. The table should have one row per source1 event. Source2's events will be used based on the common fields. There will be many instances where the same source2 event is used.

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

can you give some sample data as this is working.

index=_internal source IN (*metrics.log,*splunkd.log) app_name="cloudgateway_metrics.app" OR component=Metrics
| stats values(app_name) as app_name values(component) as component by host index
| table host index app_name component

r. Ismo

0 Karma

edrivera3
Builder

I ended up re-indexing those events but with with the additional fields included. It was not that bad because those events were from a mysql db connection. I did tried the Join command but it was very slow for the amount of data I was  pulling.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

could you try the next:

index=<your index> (source=source1 OR source=source2) 
| stats values(source*) as source* by common_field1 common_field2
| table common_field1, common_field2, source1_field1, source2_field1

r. Ismo

0 Karma

edrivera3
Builder

@isoutamoIt didn't work. It produced a table with only the common fields. The other two fields were empty.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...