Splunk Search

SPL query

manjunath_n
Engager

How to combine the events from 2 different indexes and display the results in a table, when there are no matching fields in the indexes. Please suggest.

Labels (1)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

As the guys already said, it all boils down to what you mean by "combine".

You might simply do a search across two indexes.

 You can use append, appendcols or multisearch.

Depends on what you want to achieve.

 

View solution in original post

0 Karma

manjunath_n
Engager

Trying to retrieve the correlationId from two different indexes and then use a table to show them.

correlationId field is present in index called abc and properties.correlationID is present in index called cde

Example:

index=abc OR index=cde sourcetype=json OR sourcetype=_json correlationId="*" OR properties.correlationId=* | table correlationId,properties.correltionId

when tried using above we are getting values for correlationId only

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

you could try this

index=abc OR index=cde sourcetype=json OR sourcetype=_json correlationId="*" OR properties.correlationId=* 
| eval correlationId = coalesce(correlationId, properties.correlationId)
| stats values(*) as * by correlationId

Just  replace "values(*) as *" by all "values(field1) as field1" as you need. You can also use join id needed. The correct way to do this is depending what is your real need.

r. Ismo

PickleRick
SplunkTrust
SplunkTrust

As the guys already said, it all boils down to what you mean by "combine".

You might simply do a search across two indexes.

 You can use append, appendcols or multisearch.

Depends on what you want to achieve.

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You can append the search from one index to the search from the other index. The column in the table which don't have values from one index won't have values or you could use appendcols where the results from the second search are put alongside the results from the first search without correlating the results. Having said that, you are likely to have at least one common field, the timestamp field _time so you could use that to correlate the events from the two indexes?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @manjunath_n,

reading your question, the only answer should be: it isn't possible!

but, I'm sure that it's different!

if you could share more informations maybe we could halp you.

e.g. share some samples of both the indexes to join and understand the result you would have could be a good starting point.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...