Splunk Search

Search for value of FieldA, then search FieldB, Match if contains $FieldA, then pull field_C from event with match.

ArmbrusterC
Explorer

I want to do a search for field_A in index_A. The value of field_A contains a URL minus any http(s), or query terms. I then want to use the value of field_A and search field_B from index_B for values containing it. If field_B contains field_A I want splunk to pull the value of field_C from index_B within the same event/log entry.
I have tried a few different iterations of the search but cannot seem to get the value from field_A to carry as a search term for field_B. I have read many different answer pages, and wikis. I thought I was on the right track with return, or fields commands but I am stuck.

" 
earliest =-7d index=index_A sourcetype=source_A  field_A=* | fields field_A | dedup field_A | eval = result [ search earliest=-7d index=index_B sourcetype=source_B field_B=<$field_A> ]  | fields field_B
" 

This one above is a simplified attempt, it does not work but I hope it shows the order I am trying to do things in. index_B is quite large so I want to search index_A first.

0 Karma

ramdaspr
Contributor

The join command might be useful here.

earliest =-7d index=index_A sourcetype=source_B  field_B=* | fields field_B,field_C | join type=inner field_B [ search earliest=-7d index=index_A sourcetype=source_A | fields field_A | dedup field_A | rename field_A as field_B ]  | fields field_B,field_C

If I understood the question correctly, then an inner join on the larger table B with table A would give the required output.

0 Karma

ArmbrusterC
Explorer

Thank you for the quick answer ramdaspr.
Im wondering why we are searching index_a for sourcetype_b which is not in that index. Does the JOIN statement take care of this?
I will test it when I get an opportunity and let you know.

0 Karma

ramdaspr
Contributor

My bad, it should be index_B at the start. Basically keep the larger index outside of the subsearch.

0 Karma

sree6494
New Member

is there a way we can get the count of main search before join and the final count after performing the join?

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...