Splunk Search

create a table by comparing data from 2 different indexes

arjun_hcl
Explorer

Hi,
I am trying to create a table by comparing data from 2 different indexes & compare certain search terms from one index with matching events from second index

for e.g
index1 may contain a field word and terms error, down, fatal
index2 may contain a field ticket and terms tkt1, tkt2, tkt3

idea is to write duplicate values of tickets against each matiching terms from index1

output would be like
Ticket | word
tkt1 | error
tkt1 | down
tkt1 | fatal
tkt2 | error
tkt2 | down
tkt2 | fatal
.
.
.
etc.

can someone help plz?

0 Karma

niketn
Legend

@arjun_hcl... you would need to provide one key piece of information. Do you have any correlation field between the two indexes?

Consider index and sourcetype in Splunk to be Database and tables. For correlating them we would need to establish a foreign key which is present in both.

If possible please mock up your sample events from both indexes and post them here so that we can help you with the query you need. Do let us know the sourcetype for both indexes also.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

earlhelms
Path Finder

I'm not sure if I understand the question but this seems to call for a join. Reference: https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Join

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...