Splunk Search

When I get a certain string in one search result, how do I append a field from another event that can be found through correlation of 2 other fields?

Path Finder


Best way for me to explain is by example.

example search:

host=*guac* sourcetype="syslog" | rex field=_raw "guacd\[(?<guacd>\d+)\]" | rex field=_raw "connected-listener: id=\"(?<connection_id>.+)\" email=" | search  "5b629c6f-4b1a-410a-9382-53d694c23972" OR guacd=10734

I added the last search filter just for clarity to get a small result set.

Example result set: alt text

Whenever I get a string like "Error writing data to socket", I want to append the email to that result which can be found if correlated with the guacd field and then with the connection_id field

Not sure how to do it.

Any idea?

0 Karma

Revered Legend

Try something like this

   host=*guac* sourcetype="syslog" | rex field=_raw "guacd\[(?<guacd>\d+)\]" | rex field=_raw "Connection ID is \"(?<connection_id>.+)\"" | eventstats values(connection_id) as connection_id by guacd| rex field=_raw "connected-listener: id=\"(?<connection_id2>.+)\" email=(?<email>.+)"  | eval connection_id=colesce(connection_id2,connection_id) | search  connection_id="5b629c6f-4b1a-410a-9382-53d694c23972" guacd=10734  | eventstats values(email) as email by guacd connection_id| table _time _raw guacd connection_id email 
0 Karma

Path Finder

small fix for the example query (same result set):
host=guac sourcetype="syslog" | rex field=_raw "guacd[(?\d+)]" | rex field=_raw "connected-listener: id=\"(?.+)\" email=" | rex field=_raw "Connection ID is \"(?.+)\"" | search "5b629c6f-4b1a-410a-9382-53d694c23972" OR guacd=10734 | table _time _raw guacd connection_id

alt text

0 Karma
Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...