Splunk Search

How to see if field values from index 1 shows up in index 2?

agoktas
Communicator

Do I need to do some fancy joined search here?

I have values that will show in index 2, and I want to check index 1 to see if they exist, then table results.

Is this something that I need to provide a lot more information on? (i.e.: Log examples)

At least some guidance would be helpful. 🙂

Thanks!

0 Karma

pradeepkumarg
Influencer

What you are looking for is a sub search. Make sure the field name is same across both the indexes. If not, use the rename command to match the field names

index=myIndex1 [search index=myIndex2 | table myField ]
0 Karma

agoktas
Communicator

Awesome! One last thing...

What if I want to have the dates reflect differently between both indexes?

example:
index 1 = All Time
index 2 = Today

How do I restrict to certain time frames within the search example you provided?

Thanks!

0 Karma

pradeepkumarg
Influencer

You can specify that by using time modifiers earliest and latest

Below example uses 24h for the outer search and 1h for the inner search

index=myIndex1 earliest=-24h latest=now [search index=myIndex2 earliest=-1h latest=now| table myField ]

https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/SearchTimeModifiers

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...