Splunk Search

search use case help with common field

venkasplunk
New Member

hi all,

have some query on search use case.

1) My requirement is to extract a hpotter from a log - ex: log looks like "Apr 16 14:42:51 2019 hhhhhh aaa: 12345678:job:a_b_c:hpotter"
2) I also have a log in this format, both from same index. format is "Apr 17 12:45:16 2019 hhhhhh aaa: 1234:c_b:magician:e_t:1234:ip=:x.y.z.a:action:x_y_z:detail:uname:hpotter i:ABCD lol (X/Y), time:x hours, reason:testing".

I want to have output like this , name from first log which is same in second log, but also Author and Time from second log.

Name Author Time
hpotter magician Apr 17 12:45:16

Tags (1)
0 Karma

woodcock
Esteemed Legend

Are there any fields that contain any of those key values or do we need to create everything?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

How are the name and author fields identified in each event? The location of the name field looks very different in the two sample events.

---
If this reply helps you, Karma would be appreciated.
0 Karma

efavreau
Motivator

Could you please clarify why #1 matters at all in this case? It appears the output you are looking for correlates to all the content in #2. Please confirm and then I can provide an answer.

###

If this reply helps you, an upvote would be appreciated.
0 Karma

venkasplunk
New Member

Thank you, it matters because that a_b_c is an illegal activity and want to capture those.

Yes, that's the challenge am facing. Can you pls help?

0 Karma

efavreau
Motivator

@venkasplunk Please use comments instead of answers. You can also update your question to provide clarity. Does the order of events always occur that the user commits a_b_c and then shows up in the other log? If not, what is the order of events? What is the timespan between the two events? Your examples would indicate it could be almost a day between the two events. Is that the case?

###

If this reply helps you, an upvote would be appreciated.
0 Karma

venkasplunk
New Member

Thank you, order of event is 2) comes first and then 1) comes.

Yes, you are absolutely right, timespan could be between 1hour - 12hours.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...