Matching values in fields from multiple sources

Zyon — Mon, 29 Jul 2013 11:50:02 GMT

I have two different sources, blacklisted and log. blacklisted source contains all the blacklisted IP Addresses, and log source contains network information of potential sources.

Below is the search command i use, together with the results obtained.

sourcetype="Blacklist" OR sourcetype="log" | eval blacklisted=if(sourcetype=="Blacklist",_raw,null()) | fields - _* | fields blacklisted,SRC

Results: http://tinypic.com/r/11mc5z8/5

What i need to do is to compare the two fields and display which are the IP address that matches, in order words, which IP address in my log matches the blacklisted IP address in my blacklisted.

What i tried doing to get the matching field is to use the below command

sourcetype="Blacklist" OR sourcetype="log" | eval blacklisted=if(sourcetype=="Blacklist",_raw,null()) | fields - _* | fields blacklisted,SRC | eval matches=if(blacklisted==SRC, "match", "no match")

Results: http://tinypic.com/r/10e1q2b/5

What i assume is that they are matching the field SRC which is null, to the field blacklisted, and therefore, return no matches.

May i ask if there is any suggestion to solve this problem?

Thank You.

Re: Matching values in fields from multiple sources

Ayn — Mon, 29 Jul 2013 12:07:26 GMT

Sounds to me like you should be setting up a lookup containing your blacklisted IP addresses, and then match using that lookup. I'm not really following how your current searches are meant to work - I suspect that you're confusing how some things work in Splunk.

Re: Matching values in fields from multiple sources

Zyon — Mon, 29 Jul 2013 14:44:06 GMT

Oh thanks! I think i know how to make it work. Thanks!

topic Matching values in fields from multiple sources in Splunk Dev

Matching values in fields from multiple sources

Re: Matching values in fields from multiple sources

Re: Matching values in fields from multiple sources