Splunk Search

search use case help with common field

venkasplunk
New Member

hi all,

have some query on search use case.

1) My requirement is to extract a hpotter from a log - ex: log looks like "Apr 16 14:42:51 2019 hhhhhh aaa: 12345678:job:a_b_c:hpotter"
2) I also have a log in this format, both from same index. format is "Apr 17 12:45:16 2019 hhhhhh aaa: 1234:c_b:magician:e_t:1234:ip=:x.y.z.a:action:x_y_z:detail:uname:hpotter i:ABCD lol (X/Y), time:x hours, reason:testing".

I want to have output like this , name from first log which is same in second log, but also Author and Time from second log.

Name Author Time
hpotter magician Apr 17 12:45:16

Tags (1)
0 Karma

woodcock
Esteemed Legend

Are there any fields that contain any of those key values or do we need to create everything?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

How are the name and author fields identified in each event? The location of the name field looks very different in the two sample events.

---
If this reply helps you, Karma would be appreciated.
0 Karma

efavreau
Motivator

Could you please clarify why #1 matters at all in this case? It appears the output you are looking for correlates to all the content in #2. Please confirm and then I can provide an answer.

###

If this reply helps you, an upvote would be appreciated.
0 Karma

venkasplunk
New Member

Thank you, it matters because that a_b_c is an illegal activity and want to capture those.

Yes, that's the challenge am facing. Can you pls help?

0 Karma

efavreau
Motivator

@venkasplunk Please use comments instead of answers. You can also update your question to provide clarity. Does the order of events always occur that the user commits a_b_c and then shows up in the other log? If not, what is the order of events? What is the timespan between the two events? Your examples would indicate it could be almost a day between the two events. Is that the case?

###

If this reply helps you, an upvote would be appreciated.
0 Karma

venkasplunk
New Member

Thank you, order of event is 2) comes first and then 1) comes.

Yes, you are absolutely right, timespan could be between 1hour - 12hours.

0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...