Splunk Search

How to search two different values in different text files which has same index?

gladiatorankit
Explorer

How to search two different values both the values are in different text files which has the same index and the final output want to route to a different txt file.

Tags (1)
0 Karma
1 Solution

gfuente
Motivator

Something like:

index="commonindex" (source="source1" field1="value1") OR (source="source2" field1="value2")

???

View solution in original post

gfuente
Motivator

Something like:

index="commonindex" (source="source1" field1="value1") OR (source="source2" field1="value2")

???

gladiatorankit
Explorer

Yes this worked. Thanks alot. Actually I have 1 value in File A and another in File B. I want to combine the search result and route it to different file. Please tell me how should I route the result to different file?

0 Karma

gfuente
Motivator

index=main (source="123.txt" "123") OR (source="456.txt" "456")

Im sorry, but i don´t understand what you need.

gladiatorankit
Explorer

I have two text files 123.txt and 456.txt and the values are 123 and 456 in the respective files.

I want to search such that both the files should appear when searched using values "123" and "456" and I want the output "123456" in another file.

0 Karma

gfuente
Motivator

Then:

index=main (source="source1" OR source="source2") 123

Is this what you are looking for?

0 Karma

gladiatorankit
Explorer

Well this is exactly not working. I can only search for one value how will I search for another one?
My search :-
index=main source="F:\123.txt" 123
But what if I want to add one more different source and search in that too?

0 Karma
Get Updates on the Splunk Community!

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

A Guide To Cloud Migration Success

As enterprises’ rapid expansion to the cloud continues, IT leaders are continuously looking for ways to focus ...

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...