Splunk Search
Highlighted

Struggling to correlate 2 sourcetypes

New Member

Hi,

I'm trying to correlate data from 2 different sourcetypes that share a common field. I think I should be able to use "transaction" to do this, but I'm struggling. To explain my use case, imagine the following two sets of data:

Source 1

Device      ID

Device1    123

Device
1    456

Device1    179

Device
2    456

Device2    999

Device
2    111

Device3    999

Device
3    123

Source 2

ID      Text

123    Example1

456    Example
2

179    Example3

456    Example
4

999    Example5

111    Example
6

In the first instance I want to be able to correlate them using the "ID" field, and pull back the combined fields, as follows:

Correlated

Device      ID      Text

Device1    123    Example1

Device1    456    Example4

Device1    179    Example3

Device2    456    Example4

Device2    999    Example5

Device2    111    Example6

Device3    999    Example5

Device3    123    Example1

Further I want to be able to search based on the value of that correlated "Text" field, such as showing only events where Text="Example_5"

Device2 999 Example5

Device3 999 Example5

Apologies for the long winded build up, but if anyone can get me started on how to achieve this I'd be extremely grateful, as I'm not sure if I'm going down completely the wrong track in trying to use "transaction" for this.

Tags (2)
0 Karma
Highlighted

Re: Struggling to correlate 2 sourcetypes

SplunkTrust
SplunkTrust

That sounds like a join to me:

sourcetype=source1 | join ID max=0 [search sourcetype=source2 Text="Example_5"]
Highlighted

Re: Struggling to correlate 2 sourcetypes

Ultra Champion

While a join might be the only option, it is a fairly expensive - especially for larger data sets.

With the data set in your example, you could get away with a transaction (faster);

sourcetype=type1 OR sourcetype=type2 | transaction ID | table Device ID Text | where Text="Example_5"

Hope this helps,

Kristian