Splunk Search

Lookup in multiple indexes and compare

chrishatfield21
Path Finder

I have been searching for this for a bit now and haven't come up with anything just yet. I am trying to take a list of devices in one index and see if the same name exists in another index. An example would be looking up my computer in one index and seeing if it exists in our index that contains anti-virus information. Any help or direction would be great.

Tags (3)
0 Karma

somesoni2
Revered Legend

Or something like this. (same assumption as @richgalloway, common field exists between two indexes)

index=index2 [search index=index1 | stats count by commonfield | table commonfield]
0 Karma

richgalloway
SplunkTrust
SplunkTrust

index=index1 | fields computer | join type=inner computer [search index=index2] | ...

This assumes the field computer exists in both indices. If it doesn't add a rename command before the join.

---
If this reply helps you, Karma would be appreciated.

richgalloway
SplunkTrust
SplunkTrust

Please accept the answer.

---
If this reply helps you, Karma would be appreciated.
0 Karma

chrishatfield21
Path Finder

Works great. Thanks for the fast response.

0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcment

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...