Splunk Search
Highlighted

return search with common fields

Path Finder

I need to run two sub searches. Each of these sub-searches will return a set of fields, one of them is called transactionNumber.
Then I want to the search to return only those results from the two sub-searches which have an equal transactionNumber.

How can I do this?

Tags (3)
0 Karma
Highlighted

Re: return search with common fields

Legend

Use set (http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Set):

| set intersect [search search1 | fields transactionNumber | fields - _*] [search search2 | fields transactionNumber | fields - _*]

If you want not just the transactionNumbers but also the actual events, you could feed this into a subsearch:

(search1) OR (search2) [| set intersect [search search1 | fields transactionNumber | fields - _*] [search search2 | fields transactionNumber | fields - _*] | fields transactionNumber ]

View solution in original post