Splunk Search

create a table by comparing data from 2 different indexes

arjun_hcl
Explorer

Hi,
I am trying to create a table by comparing data from 2 different indexes & compare certain search terms from one index with matching events from second index

for e.g
index1 may contain a field word and terms error, down, fatal
index2 may contain a field ticket and terms tkt1, tkt2, tkt3

idea is to write duplicate values of tickets against each matiching terms from index1

output would be like
Ticket | word
tkt1 | error
tkt1 | down
tkt1 | fatal
tkt2 | error
tkt2 | down
tkt2 | fatal
.
.
.
etc.

can someone help plz?

0 Karma

niketn
Legend

@arjun_hcl... you would need to provide one key piece of information. Do you have any correlation field between the two indexes?

Consider index and sourcetype in Splunk to be Database and tables. For correlating them we would need to establish a foreign key which is present in both.

If possible please mock up your sample events from both indexes and post them here so that we can help you with the query you need. Do let us know the sourcetype for both indexes also.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

earlhelms
Path Finder

I'm not sure if I understand the question but this seems to call for a join. Reference: https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Join

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...