Splunk Search

How to search field from log1 in to match in log2 and display field in log1 and log2 in table?

tgmvt03
Engager

Hello Everyone.

I wonder if anyone could help me with a report I'm trying to make.

Below is my sample logs format.

log1 example.

ipfield sessionfield - - timefield urlfield methodfield 

log2 example

datefied midfield sessionfield2 sessionfield3 userfield functionfield ipfield2 rolefield.

 

what I want to do is search log2 if the sessionfield in log1 exists, then print out a table that has 

userfield from log2, ipfield from log1orlog2, all sessionfield from log1 and log2,   userfield from log2, urlfield and mehtodfield and the counts of methodfield.

 

I have something like this 

(index=1 log2) OR (index=1 log1)| eval sessionfield=coalesce(sessionfield,sessionfield2,sessionfield3) | stats values(sessionfield) values(ipfield2) by sessiontuser

I got the sessionfield(s) to print but it did not print the sessionfield in log1.

I could not figure out how to print the other fields that I needed 

I don't have much experience in Splunk search so any guidance or help would be excellent.

thank you.

 

 

Labels (5)
0 Karma

tgmvt03
Engager

sorry my typo on the sessionuser, it suppose to be userfield in log2.

thank you for the wildcard query it helps me understand how coalesce works more.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There is no sessiontuser field in the example query so I'm not surprised it doesn't produce the desired results.  It's close, though.  Try this variation:

(index=1 log2) OR (index=1 log1)
| eval sessionfield=coalesce(sessionfield,sessionfield2,sessionfield3) 
| stats values(*) as * by sessionfield
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...