Splunk Search

How to filter and append a value from a subsearch into the primary search?

brajaram
Communicator

My data is in JSON format split into two different sourcetypes. Between the two sourcetypes exists a linking logID that can be used to find connected events. The query I am using currently is:

index=...sourcetype=A [search index=... sourcetype=B Other Filters| table logID ]
| table field1 field2 ...

This correctly finds events in sourcetype A that meet the filters in sourcetype B. However, I need a field (uniqueID) that only exists in sourcetype B to be printed along the events in sourcetype A.

If I do

index=...sourcetype=A [search index=... sourcetype=B Other Filters| table logID uniqueID] | table field1 field2 uniqueID it doesn't work, so how do I filter and append together in one query?

Tags (3)
0 Karma
1 Solution

somesoni2
Revered Legend

Try these

index=...sourcetype=A [search index=... sourcetype=B Other Filters| table logID ] | table logID field1 field2 ...
| append [search index=... sourcetype=B Other Filters| table logID  uniqueID  ]
| stats values(*) as * by logID

OR

index=...sourcetype=A [search index=... sourcetype=B Other Filters| table logID ] | table logID field1 field2 ...| eval from=1
| append [search index=... sourcetype=B Other Filters| table logID  uniqueID  ]
| stats values(*) as * by logID | where from=1 | fields - from logID

OR

 index=.. (sourcetype=A) OR (sourcetype=B Other Filters) | fields sourcetype logID uniqueID field1 field2 .. | stats values(*) as * by logID | where mvcount(sourcetype)=2 | table field1 field2... uniqueID

View solution in original post

somesoni2
Revered Legend

Try these

index=...sourcetype=A [search index=... sourcetype=B Other Filters| table logID ] | table logID field1 field2 ...
| append [search index=... sourcetype=B Other Filters| table logID  uniqueID  ]
| stats values(*) as * by logID

OR

index=...sourcetype=A [search index=... sourcetype=B Other Filters| table logID ] | table logID field1 field2 ...| eval from=1
| append [search index=... sourcetype=B Other Filters| table logID  uniqueID  ]
| stats values(*) as * by logID | where from=1 | fields - from logID

OR

 index=.. (sourcetype=A) OR (sourcetype=B Other Filters) | fields sourcetype logID uniqueID field1 field2 .. | stats values(*) as * by logID | where mvcount(sourcetype)=2 | table field1 field2... uniqueID
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...