How to tie in 2 different event sources to display a field value from one source based on a value from the other source.

[mninansplunk]

Hello,

Sorry, still trying to get the hang of Search queries.   I am tasked with creating a table that displays a server name from one search, with a team name from another search that corresponds with the server name.  In example,

1st Search 

index="netscaler | table servername

Results in a table like:

servername1

servername2

2nd Search

index="main | table teamname

Results in a table like

teamname1

teamname2

I need to make 1 table that will display the corresponding teamname to the servername.  Like If servername = servername2, display teamname2 in the same table row.

Does that make sense. 🙂  Let me know if any details are needed.  Not sure how to do this one.

Thanks for any help,

Tom

[ITWhisperer]

It might be helpful if you shared some sample (anonymised) events from your searches, preferably in raw format in codeblocks (using the </> button above)

[richgalloway]

The two searches have no obvious relationship to each other.  How is Splunk to know how to match a server name to a team name?

[mninansplunk]

Hello,

Thanks for your help,  I am hoping for a way in the search to say something like if name from first query = servername1 then name from second query = teamname1.  But, have no idea how to achieve that.

Thanks,

Tom

[richgalloway]

Yes, you said that in the OP, but what is the logic behind that matching?  The query needs an algorithm it can use to pair servers with teams.  Otherwise, you're looking at creating a lookup table that does the matching.