Splunk Search
Highlighted

How to relate two different events in two different indexes based on related fields?

Path Finder

So what I have are two different types of events. However, both have an key field that connect the two events together. (One event type has a keynum field that has its unique ID number, and the other has a relatedkeynum field that connects these events to the first. Is there a way to run a search on the first event types and bring up only events from the second type based on their matching keynum's?

0 Karma
Highlighted

Re: How to relate two different events in two different indexes based on related fields?

Influencer
0 Karma
Highlighted

Re: How to relate two different events in two different indexes based on related fields?

Communicator

index=otherindex [search index= | rename relatedkeynum as keynum | return $keynum ]

View solution in original post

0 Karma