Splunk Search

How would I merge the events from two log files so that it appears as if coming from a single host?

cal_dunigan
New Member

The logs are created by the same application and have the same fields.

What I am after is displaying the count of events from two hosts (of 10) as a single host in a timechart. This search breaks out authentications across 10 hosts, I want it to look like there are 9 hosts.

sourcetype=rsa_auth AUTHN_LOGIN_EVENT| timechart span=1d count by host

Tags (1)
0 Karma
1 Solution

jhupka
Path Finder

You could do it in the search with an eval to merge the two hosts' data into one:

sourcetype=rsa_auth AUTHN_LOGIN_EVENT | eval host=if(host="serverA.foo.com" OR host="serverB.foo.com", "single_server.foo.com", host) | timechart span=1d count by host

View solution in original post

jhupka
Path Finder

You could do it in the search with an eval to merge the two hosts' data into one:

sourcetype=rsa_auth AUTHN_LOGIN_EVENT | eval host=if(host="serverA.foo.com" OR host="serverB.foo.com", "single_server.foo.com", host) | timechart span=1d count by host
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...