Splunk Search

How to search a log file based on the field value extracted from another log file?

vrvasantharaj
New Member

I need to read content from a second log file based on the field value which is extracted from the first log file. I did a filter using a keyword and got search results from the first log file (say firstlog.txt). I extracted a field file_name="secondlog.txt" using regex from first log file (firstlog.txt). The second file gets created with the same name (secondlog.txt) as field value which I extracted from the first log file. I need to display the content from both the log files and I am facing difficulties in searching the second log file.

I tried the below search and second search part is not returning any results. I need to correct the highlighted part.

index="aaa" AND host="xxx" source="D:\firstlog.txt" ERROR fields file_name| append [search index="aaa" source=mvjoin("D:\", mvindex(file_name,0)) ]

Please help me with this.

0 Karma

sundareshr
Legend

Try this (this assumes file_name is a field that has been extracted and has multiple values)

index="aaa" source=[search index="aaa" AND host="xxx" source="D:\\firstlog.txt" ERROR | eval search="d:\\\\".mvindex(file_name, 0)]
0 Karma

vrvasantharaj
New Member

Thanks for the help. Unfortunately, it did not work out.

0 Karma

sundareshr
Legend

Can the share the result of these two requests

index="aaa" AND host="xxx" source="D:\\firstlog.txt" ERROR | table file_name

*AND*

Click on Job>>Inspect Job, look for litsearch (Ctrl+F litsearch) in the popup window. Share that.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...