Splunk Search

merge search between 2 index

Path Finder

We need to merge results from two indexes,

I mean, I need any successfully login for users at the same time from two indexes, means I have the SAP logs and windows logs, I need any user access the SAP at 8 AM and at the same time this user access the windows logs. I need to show the count access and users from SAP index and need to show all sources, all destinations from windows index at the same time from two indexes:

for clarification you can see what I need show in the table:
users, count access from SAP index, count access from windows index, all sources from windows index, all destinations from windows index, and time.

Regarding the all sources from windows index, and all destinations from windows index, we need to view all sources and destinations which used from this users values(dest) values(src).

No need to view the source if owns it from user, we need the source if access from another user not from user which owns this device

no need to display in the table if user access from his device, If was user is aaaaa and he owns device (hqr-aaaaa), no need to display in the table if user=aaaaa and source=hqr-aaaaa?

Please support me in that.


0 Karma


Were you ever able to resolve this issue/question?

If not, did you try appending the windows index or SAP index in a sub-search then doing a stats command for the fields you need based on the user?

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...