Splunk Search

create a table by comparing data from 2 different indexes


I am trying to create a table by comparing data from 2 different indexes & compare certain search terms from one index with matching events from second index

for e.g
index1 may contain a field word and terms error, down, fatal
index2 may contain a field ticket and terms tkt1, tkt2, tkt3

idea is to write duplicate values of tickets against each matiching terms from index1

output would be like
Ticket | word
tkt1 | error
tkt1 | down
tkt1 | fatal
tkt2 | error
tkt2 | down
tkt2 | fatal

can someone help plz?

0 Karma


@arjun_hcl... you would need to provide one key piece of information. Do you have any correlation field between the two indexes?

Consider index and sourcetype in Splunk to be Database and tables. For correlating them we would need to establish a foreign key which is present in both.

If possible please mock up your sample events from both indexes and post them here so that we can help you with the query you need. Do let us know the sourcetype for both indexes also.

| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Path Finder

I'm not sure if I understand the question but this seems to call for a join. Reference: https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Join

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...