topic Re: Looping in SPLUNK Query in Splunk Enterprise

Looping in SPLUNK Query

Janani_Krish — Mon, 07 Sep 2020 11:24:03 GMT

Hello,

I have a table of IP's and my requirement is to fetch raw data for all the IP's from each and every sourcetype having the IP.

My query is like below,

1.sourcetype="IPs"|dedup ip|table ip

So I want to use below logic,

For each and every IP in the table, run the below query,

2.sourcetype!="IPs"|table sourcetype,_raw

Help me to run the second query for each and every IP in 1st query and merge the tables.

Re: Looping in SPLUNK Query

thambisetty — Mon, 07 Sep 2020 11:54:22 GMT

can you explain your query with examples?

Re: Looping in SPLUNK Query

ITWhisperer — Mon, 07 Sep 2020 12:06:13 GMT

Have you tried the join command to link the two queries by ip?

Re: Looping in SPLUNK Query

Janani_Krish — Mon, 07 Sep 2020 14:36:16 GMT

Hi @ITWhisperer ,

I cannot use join because I do not have a single meta in my second sub query.

1.In my 1st part of query I have single sourcetpe which is IPs and meta as IP.

2.My second part of query has to search for the ip address in all sourcetype other than sourcetype=IPs.

So since Ip is captured in different metas in rest all sourcetype,this makes it difficult to use join command.

Eg: It is src_ip in sourcetype1, dst_ip in sourcetype 2 etc.,

Re: Looping in SPLUNK Query

Janani_Krish — Mon, 07 Sep 2020 14:55:54 GMT

Hello @thambisetty ,

Currently I have my query in 2 parts.
1. sourcetype="IPs"|dedup IP|table IP
2. sourcetype!="IPs"|table sourcetype,_raw

Currently I have the data as below from 1st part of query.
128.0.0.9
234.56.78.98
45.76.89.98

I want these Ips to be mapped with its respective raw logs where the IP may or may not be captured in different/more than one sourcetype as below by combining the second part of query.

128.0.0.9 sourcetype 1 raw log
sourcetype 2 raw log
234.56.78.98 sourcetype 2 raw log
45.76.89.98 sourcetype 3 raw log
sourcetype n raw log

Re: Looping in SPLUNK Query

thambisetty — Tue, 08 Sep 2020 05:48:46 GMT

there could be many events in a single sourcetype that matches one particular IP, this will create search performance issue and it may take hours/days if you are searching in GBs of data.

The reason for not using IP field in sub search is because your other source types may not have have field IP as I can see you provided only table sourcetype, _raw. The above search will do basic search with just IPs rather than IP and IP_value. we can't group the sourcetype and _raw by IP because IP field could be different in different sourcetypes, if you think IP field is present in all source types, you can add below to the search.

| stats values(sourcetype) as sourcetype values(_raw) as _raw by IP

give a thumps up if my answer gives a clue.