Other Usage

multiple sourcetypes


Hello, I'm having issue with getting a report of users Action, with fullname and username = email.. But the sourcetypes have username. But one has username and  fullname but not the action. Also on the username part one has an uppercase U and other has a lower case u..  I trying to get the fullname,username,action.. This is what I have tried 

index=hv_lastpass [search source=lastpass_users fullname="*,*" [search sourcetype="lastpass:activity" Action="Failed Login Attempt"| return fullname] |return Action,Time, Username] | table fullname,Username, Action ,Time

index=hv_lastpass | join type=left username [search source=lastpass_users]|join type=left Username [search sourcetype="lastpass:activity"]| table fullname,Username, Action ,Time

thank you 

Labels (2)
Tags (2)
0 Karma


Thank you for the help..

0 Karma


There are a number of ways to combine data from different data sets, but often, the best way to combine data from different data sets is to use these as search queries initially then aggregate down by the common attributes.

It's not clear where Action, [Uu]sername and Time fields are (is Time a specific field or is it _time?), but something like this is a start.

index=hv_lastpass (source=lastpass_users OR (sourcetype="lastpass:activity" Action="Failed Login Attempt"))
| eval _time=if(source="lastpass_users", null(), _time)
| eval Username=coalesce(Username, username)
| stats values(Action) as Action values(fullname) as fullname values(_time) as _time by Username

This collects all Actions, fullnames and _time fields for all fields by Username, which is either username OR Username (coalesce...)

Depending on what you want to do with that data and how to render it, it will require some tweaks.


Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...