Splunk Search

Find common values starting with

Mary666
Communicator

Hi There,

 

Any guidance on how to find common values starting with similar values from two different sources?

 

exp:

 

Source: 1 field:SerialId value: 123_abc

Source:  2 field: SerialId value: 123_abcde

 

so if the values start with the first common 6 letters and numbers-find those matching.

 

any advice on how to approach this?

Labels (5)
0 Karma

vhharanpositka
Path Finder

Hi @Mary666 

 

As per my understanding, you can use the field name and the value with the starting common character with a wildcard.

 

Source: 1

field:SerialId value: 123*

Source:  2

field: SerialId value: 123*

This will fetch the common values from that fields.

 

Example Screenprint:

vhharanpositka_1-1635735009295.png

 

Thanks

 

0 Karma

Mary666
Communicator

Thanks, but I should have been more detailed. The values can be numbers and letters and can be different in size. So basically I am trying to do this:

Index="123", team=green, ID=123Azz_mpr

Index="456" , team=blue, ID=123Cxx_1


Desired result: 
ID=123

I have tried 
| eval ShortMessage= substr(ID1,3)  this does work, but it does not include the data for both indexes. 

0 Karma

vhharanpositka
Path Finder

Try this,

 

index="123" OR index="456" (team=green OR  team=blue) ID=123*

 

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...