Splunk Search

Find common values starting with

Mary666
Communicator

Hi There,

 

Any guidance on how to find common values starting with similar values from two different sources?

 

exp:

 

Source: 1 field:SerialId value: 123_abc

Source:  2 field: SerialId value: 123_abcde

 

so if the values start with the first common 6 letters and numbers-find those matching.

 

any advice on how to approach this?

Labels (5)
0 Karma

vhharanpositka
Path Finder

Hi @Mary666 

 

As per my understanding, you can use the field name and the value with the starting common character with a wildcard.

 

Source: 1

field:SerialId value: 123*

Source:  2

field: SerialId value: 123*

This will fetch the common values from that fields.

 

Example Screenprint:

vhharanpositka_1-1635735009295.png

 

Thanks

 

0 Karma

Mary666
Communicator

Thanks, but I should have been more detailed. The values can be numbers and letters and can be different in size. So basically I am trying to do this:

Index="123", team=green, ID=123Azz_mpr

Index="456" , team=blue, ID=123Cxx_1


Desired result: 
ID=123

I have tried 
| eval ShortMessage= substr(ID1,3)  this does work, but it does not include the data for both indexes. 

0 Karma

vhharanpositka
Path Finder

Try this,

 

index="123" OR index="456" (team=green OR  team=blue) ID=123*

 

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...