Splunk Search

How to output matching fields

harshavrath
Contributor

Hi,

I have indexed few records from my DB into Splunk & an log file is also indexed into Splunk. There is one matching Field in both the indexed sources i.e, Serial Number.

My question is how can i output only the matching Events with the same Serial Number using Splunk Search.

Any Help is Appreciated,

Thanks.

Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Here's one way:

<DB search> | join SerialNumber [<log file search>] | ...
---
If this reply helps you, Karma would be appreciated.

richgalloway
SplunkTrust
SplunkTrust

You showed your query previously. Now we need to see sample events.

---
If this reply helps you, Karma would be appreciated.
0 Karma

harshavrath
Contributor

The query that I used is

source="Logfile.log" | rex field=_raw "(?i) Number: (?P[^ ]+)" | search SERIAL_NUM_CD="*" | join SERIAL_NUM_CD[search source="IndexeddbDATA"]

I’m able to get the matching fields as output from the Log file but my requirement is I want the matching fields from both the log as well as DB to be displayed.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It would be helpful to see some sample events from each source.

---
If this reply helps you, Karma would be appreciated.
0 Karma

harshavrath
Contributor

in query its Caps only, after i commented it was automatically converted into lower case.

0 Karma

somesoni2
Revered Legend

The case of field extracted and field used for join is different. Splunk is case sensitive in field names (always). ALso, check if you have field SERIAL_NUM_CD in the source IndexeddbDATA with same case.

0 Karma

harshavrath
Contributor

source="logFILE"| rex field=_raw "(?i) Number: (?P[^ ]+)"|join SERIAL_NUM_CD[search source="IndexeddbDATA"]
I tried the above query its working, but other non matching fields are also displayed.

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...