Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

Combining 2 different search results based on fields

$
0
0

Hello,

I have 2 different searches for 2 different sourcetypes with field extractions. I'm doing the field extractions for search1 for xml data.

search1:

sourcetype=xmlapp | xmlkv

search2:

sourcetype=app2

I'd like to combine searches in such a way that when field2 from search2 does NOT match any existing field1 from search1, I need to create an alert. Any help is greatly appreciated.


Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>