I have indexed few records from my DB into Splunk & an log file is also indexed into Splunk. There is one matching Field in both the indexed sources i.e, Serial Number.
My question is how can i output only the matching Events with the same Serial Number using Splunk Search.
Any Help is Appreciated,
Here's one way:
<DB search> | join SerialNumber [<log file search>] | ...
You showed your query previously. Now we need to see sample events.
The query that I used is
source="Logfile.log" | rex field=_raw "(?i) Number: (?P
I’m able to get the matching fields as output from the Log file but my requirement is I want the matching fields from both the log as well as DB to be displayed.
It would be helpful to see some sample events from each source.
in query its Caps only, after i commented it was automatically converted into lower case.
The case of field extracted and field used for join is different. Splunk is case sensitive in field names (always). ALso, check if you have field SERIAL_NUM_CD in the source IndexeddbDATA with same case.
source="logFILE"| rex field=_raw "(?i) Number: (?P
I tried the above query its working, but other non matching fields are also displayed.