Splunk Search

merge search between 2 index

Path Finder

We need to merge results from two indexes,

I mean, I need any successfully login for users at the same time from two indexes, means I have the SAP logs and windows logs, I need any user access the SAP at 8 AM and at the same time this user access the windows logs. I need to show the count access and users from SAP index and need to show all sources, all destinations from windows index at the same time from two indexes:

for clarification you can see what I need show in the table:
users, count access from SAP index, count access from windows index, all sources from windows index, all destinations from windows index, and time.

Regarding the all sources from windows index, and all destinations from windows index, we need to view all sources and destinations which used from this users values(dest) values(src).

No need to view the source if owns it from user, we need the source if access from another user not from user which owns this device

no need to display in the table if user access from his device, If was user is aaaaa and he owns device (hqr-aaaaa), no need to display in the table if user=aaaaa and source=hqr-aaaaa?

Please support me in that.


0 Karma


Were you ever able to resolve this issue/question?

If not, did you try appending the windows index or SAP index in a sub-search then doing a stats command for the fields you need based on the user?

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...