Splunk Search

How to search two different values in different text files which has same index?

gladiatorankit
Explorer

How to search two different values both the values are in different text files which has the same index and the final output want to route to a different txt file.

Tags (1)
0 Karma
1 Solution

gfuente
Motivator

Something like:

index="commonindex" (source="source1" field1="value1") OR (source="source2" field1="value2")

???

View solution in original post

gfuente
Motivator

Something like:

index="commonindex" (source="source1" field1="value1") OR (source="source2" field1="value2")

???

gladiatorankit
Explorer

Yes this worked. Thanks alot. Actually I have 1 value in File A and another in File B. I want to combine the search result and route it to different file. Please tell me how should I route the result to different file?

0 Karma

gfuente
Motivator

index=main (source="123.txt" "123") OR (source="456.txt" "456")

Im sorry, but i don´t understand what you need.

gladiatorankit
Explorer

I have two text files 123.txt and 456.txt and the values are 123 and 456 in the respective files.

I want to search such that both the files should appear when searched using values "123" and "456" and I want the output "123456" in another file.

0 Karma

gfuente
Motivator

Then:

index=main (source="source1" OR source="source2") 123

Is this what you are looking for?

0 Karma

gladiatorankit
Explorer

Well this is exactly not working. I can only search for one value how will I search for another one?
My search :-
index=main source="F:\123.txt" 123
But what if I want to add one more different source and search in that too?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...

Network to App: Observability Unlocked [May & June Series]

In today’s digital landscape, your environment is no longer confined to the data center. It spans complex ...

SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...