Hi everyone,
I just start using splunk and hit a road block.
Using two sources (Loaninfo and Loanapp), my end goal is to extract the "APPLICATION_DATE" found in Loanapp using the "ACCOUNT_NUMBER" and "APPLICATION_ID" from Loaninfo as references.
index=[test_index] source="*LOANINFO*" REFERENCE="SPRING SALE 16" OR REFERENCE="SPRING SALE 17"
|dedup ACCOUNT_NUMBER, LOAN_ID
|table ACCOUNT_NUMBER, LOAN_ID, ORIGINAL_BALANCE, LOAN_BALANCE,BUREAU_SCORE_EQUIFAX,PAYMENT_COUNT,PAYMENT_FREQUENCY,PAYMENT_SKIPS,LOAN_PURPOSE,OPEN_DATE,CLOSE_DATE,APPLICATION_DATE,APPLICATION_ID,REFERENCE
|rename LOAN_BALANCE as "CURRENT_BALANCE"
|sort REFERENCE, ACCOUNT_NUMBER
Depending on the manager's response, we might have to search a third source (TRACKINGINFO) to pick up specific detail on the loans like make and model of the car.
My problem right now is not knowing what the syntax to reference two (possibly three) sources using the information found in another source.
Thank you in advance.
"Help Me Splunk Answers, You're my only hope."
... View more