Splunk Search

How to search if a user in Log A also appears in Log B?

eichfuss
Path Finder

Hi community,

propably a simple question, but I still hanging. I need a search over two logfiles, which shows me all users listed in both logs.

Example:

LogA 
TIME, USER, GROUP
14.10.2014 14:03:45, user=Adam, group=alpha
14.10.2014 14:03:35, user=Bert, group=alpha
14.10.2014 14:03:25, user=Conny, group=alpha
14.10.2014 14:03:15, user=Norman, group=beta
14.10.2014 14:03:05, user=Fred, group=beta
14.10.2014 14:02:55, user=John, group=alpha
14.10.2014 14:02:45, user=Steve, group=beta
14.10.2014 14:02:35, user=Bob, group=alpha

LogB 
TIME, USER, DEP
14.10.2014 13:03:45, user=Adam, dep=sales
14.10.2014 13:03:35, user=Gregor, dep=sales
14.10.2014 12:03:25, user=Conny, dep=sales
14.10.2014 13:03:15, user=Jeff, dep=marketing
14.10.2014 12:03:05, user=Fred, dep=marketing
14.10.2014 13:02:55, user=Paul, dep=marketing
14.10.2014 13:02:45, user=Steve, dep=sales
14.10.2014 13:02:35, user=Rod, dep=sales

Now show me all Users which are in LogB and in LogA. (Adam, Conny, Fred, Steve)
Surely a simple search, so sorry for this question. 🙂

Thanks a lot
Cheers, Sven

0 Karma
1 Solution

eichfuss
Path Finder

I found a solution, not really nice but it does the job.

index=test source="/opt/test_logs/logB.log" OR source="/opt/test_logs/logA.log" | transaction fields=user | search source="/opt/test_logs/logA.log" AND source="/opt/test_logs/logB.log" | table user

View solution in original post

eichfuss
Path Finder

I found a solution, not really nice but it does the job.

index=test source="/opt/test_logs/logB.log" OR source="/opt/test_logs/logA.log" | transaction fields=user | search source="/opt/test_logs/logA.log" AND source="/opt/test_logs/logB.log" | table user

View solution in original post

aweitzman
Motivator

Something like this should get you started:

source="LogA" [search source="LogB" | table user | dedup user] | table user | dedup user

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!