Splunk Search

How to tie in 2 different event sources to display a field value from one source based on a value from the other source.

mninansplunk
Path Finder

Hello,

Sorry, still trying to get the hang of Search queries.   I am tasked with creating a table that displays a server name from one search, with a team name from another search that corresponds with the server name.  In example,

1st Search 

index="netscaler | table servername

Results in a table like:

servername1

servername2

 

2nd Search

index="main | table teamname

Results in a table like

teamname1

teamname2

 

I need to make 1 table that will display the corresponding teamname to the servername.  Like If servername = servername2, display teamname2 in the same table row.

Does that make sense. 🙂  Let me know if any details are needed.  Not sure how to do this one.

Thanks for any help,

Tom

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It might be helpful if you shared some sample (anonymised) events from your searches, preferably in raw format in codeblocks (using the </> button above)

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The two searches have no obvious relationship to each other.  How is Splunk to know how to match a server name to a team name?

---
If this reply helps you, Karma would be appreciated.
0 Karma

mninansplunk
Path Finder

Hello,

Thanks for your help,  I am hoping for a way in the search to say something like if name from first query = servername1 then name from second query = teamname1.  But, have no idea how to achieve that.

Thanks,

Tom

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, you said that in the OP, but what is the logic behind that matching?  The query needs an algorithm it can use to pair servers with teams.  Otherwise, you're looking at creating a lookup table that does the matching.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...