Splunk Search

How to search if a user in Log A also appears in Log B?

eichfuss
Path Finder

Hi community,

propably a simple question, but I still hanging. I need a search over two logfiles, which shows me all users listed in both logs.

Example:

LogA 
TIME, USER, GROUP
14.10.2014 14:03:45, user=Adam, group=alpha
14.10.2014 14:03:35, user=Bert, group=alpha
14.10.2014 14:03:25, user=Conny, group=alpha
14.10.2014 14:03:15, user=Norman, group=beta
14.10.2014 14:03:05, user=Fred, group=beta
14.10.2014 14:02:55, user=John, group=alpha
14.10.2014 14:02:45, user=Steve, group=beta
14.10.2014 14:02:35, user=Bob, group=alpha

LogB 
TIME, USER, DEP
14.10.2014 13:03:45, user=Adam, dep=sales
14.10.2014 13:03:35, user=Gregor, dep=sales
14.10.2014 12:03:25, user=Conny, dep=sales
14.10.2014 13:03:15, user=Jeff, dep=marketing
14.10.2014 12:03:05, user=Fred, dep=marketing
14.10.2014 13:02:55, user=Paul, dep=marketing
14.10.2014 13:02:45, user=Steve, dep=sales
14.10.2014 13:02:35, user=Rod, dep=sales

Now show me all Users which are in LogB and in LogA. (Adam, Conny, Fred, Steve)
Surely a simple search, so sorry for this question. 🙂

Thanks a lot
Cheers, Sven

0 Karma
1 Solution

eichfuss
Path Finder

I found a solution, not really nice but it does the job.

index=test source="/opt/test_logs/logB.log" OR source="/opt/test_logs/logA.log" | transaction fields=user | search source="/opt/test_logs/logA.log" AND source="/opt/test_logs/logB.log" | table user

View solution in original post

eichfuss
Path Finder

I found a solution, not really nice but it does the job.

index=test source="/opt/test_logs/logB.log" OR source="/opt/test_logs/logA.log" | transaction fields=user | search source="/opt/test_logs/logA.log" AND source="/opt/test_logs/logB.log" | table user

aweitzman
Motivator

Something like this should get you started:

source="LogA" [search source="LogB" | table user | dedup user] | table user | dedup user

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Brett Adams

In our third Spotlight feature, we're excited to shine a light on Brett—a Splunk consultant, innovative ...

Index This | What can you do to make 55,555 equal 500?

April 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...