Splunk search for 2 deferent log line from 2 deferent sources

[bhatganapatik]

Hello Forum

I am facing problem related with 2 lines search 

my logs has information like this

1:  data received 

2: data origin form XXXXX company 

3: data identifier code  is  YYYYY  

4.  data not supported 

want  search  XXXXX and YYYYY  (i.e Manufacturer name and data identifier code)  and  get the result in one single query. In our case both information are received in deferent log lines. 

Can someone help us here to get the search string format. 

Thanks in advance. 

[gcusello]

Hi @bhatganapatik,

you should share some additional information to better help you!

In addition:

• you have two different groups of events to correlate or both fields are in the same event?
• you want to correlate events from both the sources or only search for a pair of values (e.g. company="company1" and data_identifier_code="12345")?
• did you already extracted fields? if not you should also share a sample of both sources.
• is there a common key between the two sources (e.g. data_identifier_code)?

Ciao.

Giuseppe