Splunk Search

How to output matching fields

harshavrath
Contributor

Hi,

I have indexed few records from my DB into Splunk & an log file is also indexed into Splunk. There is one matching Field in both the indexed sources i.e, Serial Number.

My question is how can i output only the matching Events with the same Serial Number using Splunk Search.

Any Help is Appreciated,

Thanks.

Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Here's one way:

<DB search> | join SerialNumber [<log file search>] | ...
---
If this reply helps you, Karma would be appreciated.

richgalloway
SplunkTrust
SplunkTrust

You showed your query previously. Now we need to see sample events.

---
If this reply helps you, Karma would be appreciated.
0 Karma

harshavrath
Contributor

The query that I used is

source="Logfile.log" | rex field=_raw "(?i) Number: (?P[^ ]+)" | search SERIAL_NUM_CD="*" | join SERIAL_NUM_CD[search source="IndexeddbDATA"]

I’m able to get the matching fields as output from the Log file but my requirement is I want the matching fields from both the log as well as DB to be displayed.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It would be helpful to see some sample events from each source.

---
If this reply helps you, Karma would be appreciated.
0 Karma

harshavrath
Contributor

in query its Caps only, after i commented it was automatically converted into lower case.

0 Karma

somesoni2
Revered Legend

The case of field extracted and field used for join is different. Splunk is case sensitive in field names (always). ALso, check if you have field SERIAL_NUM_CD in the source IndexeddbDATA with same case.

0 Karma

harshavrath
Contributor

source="logFILE"| rex field=_raw "(?i) Number: (?P[^ ]+)"|join SERIAL_NUM_CD[search source="IndexeddbDATA"]
I tried the above query its working, but other non matching fields are also displayed.

0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...