Splunk Search
Highlighted

How to search for a value in multiple fields

Path Finder

I have 2 sources in separate indexes; the first contains a field "appId"; to get the human readable (appDisplayName) I need to search the 2nd source. Normally I'd do this with a subsearch:

index=index2 sourcetype=st2 
    [search index=index1 sourcetype=st1 | stats values(appId) as appId |format]
|stats values(appDisplayName) as appDisplayName by appId

The problem I'm running into is the ID for the app in the first source is always called "appId" but depending on the type of app (which i don't know from the first source); appId will either correspond to 1 of 2 fields in the second source; it will either be "appId" or "resourceId". I need to find "appId" from the 1st source in either "appId" or "resourceId" in the second source and the corresponding human readable will either be "appDisplayName" or "resourceDisplayName" in the second source.

Any ideas on how to approach this?

Thanks!

Labels (2)
0 Karma
Highlighted

Re: How to search for a value in multiple fields

Motivator

You can always eval the multiple fields into one using coalesce.

|eval appId = coalesce(appId, resourceId)
|eval appDisplayName = colaesce(appDisplayName, resourceDisplayName)

A nice blog post about coalesce:
https://www.splunk.com/en_us/blog/tips-and-tricks/search-command-coalesce.html

------------
Hope I was able to help you. If so, an upvote would be appreciated.
0 Karma
Highlighted

Re: How to search for a value in multiple fields

Path Finder

Thanks! I wish I could accept both answers.

0 Karma
Highlighted

Re: How to search for a value in multiple fields

SplunkTrust
SplunkTrust

Don't use a subsearch where the stats can handle connecting the two. This is called the "Splunk soup" method.

(index=index2 sourcetype=st2) OR 
(index=index1 sourcetype=st1)
 | fields appId, resourceId appDisplayName resourceDisplayName
 | rename COMMENT as "above selects only the record types and fields you need" 

 | rename COMMENT as "create synthetic fields as per diogofm answer" 
 | eval appId = coalesce(appId, resourceId)
 | eval appDisplayName = colaesce(appDisplayName, resourceDisplayName)

 | rename COMMENT as "stats together for final result" 
 | stats values(appDisplayName) as appDisplayName by appId

View solution in original post

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.