How to output matching fields

[harshavrath]

Hi,

I have indexed few records from my DB into Splunk & an log file is also indexed into Splunk. There is one matching Field in both the indexed sources i.e, Serial Number.

My question is how can i output only the matching Events with the same Serial Number using Splunk Search.

Any Help is Appreciated,

Thanks.

[richgalloway]

Here's one way:

<DB search> | join SerialNumber [<log file search>] | ...

[richgalloway]

You showed your query previously. Now we need to see sample events.

[harshavrath]

The query that I used is

source="Logfile.log" | rex field=_raw "(?i) Number: (?P[^ ]+)" | search SERIAL_NUM_CD="*" | join SERIAL_NUM_CD[search source="IndexeddbDATA"]

I’m able to get the matching fields as output from the Log file but my requirement is I want the matching fields from both the log as well as DB to be displayed.

[richgalloway]

It would be helpful to see some sample events from each source.

[harshavrath]

in query its Caps only, after i commented it was automatically converted into lower case.

[somesoni2]

The case of field extracted and field used for join is different. Splunk is case sensitive in field names (always). ALso, check if you have field SERIAL_NUM_CD in the source IndexeddbDATA with same case.

[harshavrath]

source="logFILE"| rex field=_raw "(?i) Number: (?P[^ ]+)"|join SERIAL_NUM_CD[search source="IndexeddbDATA"]
I tried the above query its working, but other non matching fields are also displayed.