Splunk Search

How to output matching fields

harshavrath
Contributor

Hi,

I have indexed few records from my DB into Splunk & an log file is also indexed into Splunk. There is one matching Field in both the indexed sources i.e, Serial Number.

My question is how can i output only the matching Events with the same Serial Number using Splunk Search.

Any Help is Appreciated,

Thanks.

Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Here's one way:

<DB search> | join SerialNumber [<log file search>] | ...
---
If this reply helps you, an upvote would be appreciated.

richgalloway
SplunkTrust
SplunkTrust

You showed your query previously. Now we need to see sample events.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

harshavrath
Contributor

The query that I used is

source="Logfile.log" | rex field=_raw "(?i) Number: (?P[^ ]+)" | search SERIAL_NUM_CD="*" | join SERIAL_NUM_CD[search source="IndexeddbDATA"]

I’m able to get the matching fields as output from the Log file but my requirement is I want the matching fields from both the log as well as DB to be displayed.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It would be helpful to see some sample events from each source.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

harshavrath
Contributor

in query its Caps only, after i commented it was automatically converted into lower case.

0 Karma

somesoni2
Revered Legend

The case of field extracted and field used for join is different. Splunk is case sensitive in field names (always). ALso, check if you have field SERIAL_NUM_CD in the source IndexeddbDATA with same case.

0 Karma

harshavrath
Contributor

source="logFILE"| rex field=_raw "(?i) Number: (?P[^ ]+)"|join SERIAL_NUM_CD[search source="IndexeddbDATA"]
I tried the above query its working, but other non matching fields are also displayed.

0 Karma