Splunk Search

How to search if a user in Log A also appears in Log B?

eichfuss
Path Finder

Hi community,

propably a simple question, but I still hanging. I need a search over two logfiles, which shows me all users listed in both logs.

Example:

LogA 
TIME, USER, GROUP
14.10.2014 14:03:45, user=Adam, group=alpha
14.10.2014 14:03:35, user=Bert, group=alpha
14.10.2014 14:03:25, user=Conny, group=alpha
14.10.2014 14:03:15, user=Norman, group=beta
14.10.2014 14:03:05, user=Fred, group=beta
14.10.2014 14:02:55, user=John, group=alpha
14.10.2014 14:02:45, user=Steve, group=beta
14.10.2014 14:02:35, user=Bob, group=alpha

LogB 
TIME, USER, DEP
14.10.2014 13:03:45, user=Adam, dep=sales
14.10.2014 13:03:35, user=Gregor, dep=sales
14.10.2014 12:03:25, user=Conny, dep=sales
14.10.2014 13:03:15, user=Jeff, dep=marketing
14.10.2014 12:03:05, user=Fred, dep=marketing
14.10.2014 13:02:55, user=Paul, dep=marketing
14.10.2014 13:02:45, user=Steve, dep=sales
14.10.2014 13:02:35, user=Rod, dep=sales

Now show me all Users which are in LogB and in LogA. (Adam, Conny, Fred, Steve)
Surely a simple search, so sorry for this question. 🙂

Thanks a lot
Cheers, Sven

0 Karma
1 Solution

eichfuss
Path Finder

I found a solution, not really nice but it does the job.

index=test source="/opt/test_logs/logB.log" OR source="/opt/test_logs/logA.log" | transaction fields=user | search source="/opt/test_logs/logA.log" AND source="/opt/test_logs/logB.log" | table user

View solution in original post

eichfuss
Path Finder

I found a solution, not really nice but it does the job.

index=test source="/opt/test_logs/logB.log" OR source="/opt/test_logs/logA.log" | transaction fields=user | search source="/opt/test_logs/logA.log" AND source="/opt/test_logs/logB.log" | table user

aweitzman
Motivator

Something like this should get you started:

source="LogA" [search source="LogB" | table user | dedup user] | table user | dedup user

0 Karma
Get Updates on the Splunk Community!

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...

AI Adoption Hub Launch | Curated Resources to Get Started with AI in Splunk

Hey Splunk Practitioners and AI Enthusiasts! It’s no secret (or surprise) that AI is at the forefront of ...