Splunk Search

Stringing together searches

ecnausysadm
Explorer

I have searches for two files that are related but the incoming and outgoing file names differ, basically it's an incoming order from a buyer and then the outgoing message to the supplier;
incoming_filename | transaction source host
outgoing_filename | transaction source host

Both of these give the required search results when run separately.
Now I want to be able to put both searches in and display the results, basically join the search for the incoming and outgoing files so I can see when they came in and went out in their separate logs.

I can get APPEND to partially work so I think that might be the right path, eg this returns the results for incoming_filename but it doesn't show anything for the outgoing_filename search after the APPEND;
incoming_filename | transaction source host APPEND [search outgoing_filename | transaction source host]

This might be obvious, but I haven't found a way as I'm new to Splunk and not sure if I am on the right track or should be using some other operator (I also tried OR and JOIN with no luck).

Cheers,
Mark

Tags (2)
0 Karma
1 Solution

Ayn
Legend

It sounds like you should be able to accomplish what you want simply by having an initial OR clause in your search:

incoming_filename OR outgoing_filename | transaction source host

You mentioned that you've tried OR without success - can you elaborate on what you tried and why it didn't work?

View solution in original post

youngc_splunk
Splunk Employee
Splunk Employee

@ecnausysadm , it looks like you're trying to process EDIs.  We now have solutions accelerator for EDIs.  Would like to share what we have if you are interested.

0 Karma

Ayn
Legend

It sounds like you should be able to accomplish what you want simply by having an initial OR clause in your search:

incoming_filename OR outgoing_filename | transaction source host

You mentioned that you've tried OR without success - can you elaborate on what you tried and why it didn't work?

ecnausysadm
Explorer

Yep that was it!
I thought I had to run search1 and then search2 and join them, I didn't even think of doing the OR based on the unique search string (ie the filename). In hindsight that's pretty obvious.

I had tried;
PO_15485669.135 | transaction source host OR PO20120526_6839471.EDI | transaction source host

Thanks for that.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...