I have indexed few records from my DB into Splunk & an log file is also indexed into Splunk. There is one matching Field in both the indexed sources i.e, Serial Number.
My question is how can i output only the matching Events with the same Serial Number using Splunk Search.
Any Help is Appreciated,
The query that I used is
source="Logfile.log" | rex field=_raw "(?i) Number: (?P
I’m able to get the matching fields as output from the Log file but my requirement is I want the matching fields from both the log as well as DB to be displayed.
The case of field extracted and field used for join is different. Splunk is case sensitive in field names (always). ALso, check if you have field SERIAL_NUM_CD in the source IndexeddbDATA with same case.
source="logFILE"| rex field=_raw "(?i) Number: (?P
I tried the above query its working, but other non matching fields are also displayed.