Splunk Search

How to search two different values in different text files which has same index?

gladiatorankit
Explorer

How to search two different values both the values are in different text files which has the same index and the final output want to route to a different txt file.

Tags (1)
0 Karma
1 Solution

gfuente
Motivator

Something like:

index="commonindex" (source="source1" field1="value1") OR (source="source2" field1="value2")

???

View solution in original post

gfuente
Motivator

Something like:

index="commonindex" (source="source1" field1="value1") OR (source="source2" field1="value2")

???

gladiatorankit
Explorer

Yes this worked. Thanks alot. Actually I have 1 value in File A and another in File B. I want to combine the search result and route it to different file. Please tell me how should I route the result to different file?

0 Karma

gfuente
Motivator

index=main (source="123.txt" "123") OR (source="456.txt" "456")

Im sorry, but i don´t understand what you need.

gladiatorankit
Explorer

I have two text files 123.txt and 456.txt and the values are 123 and 456 in the respective files.

I want to search such that both the files should appear when searched using values "123" and "456" and I want the output "123456" in another file.

0 Karma

gfuente
Motivator

Then:

index=main (source="source1" OR source="source2") 123

Is this what you are looking for?

0 Karma

gladiatorankit
Explorer

Well this is exactly not working. I can only search for one value how will I search for another one?
My search :-
index=main source="F:\123.txt" 123
But what if I want to add one more different source and search in that too?

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...