https://community.splunk.com/t5/Getting-Data-In/How-to-use-fields-from-different-source-types-in-the-same-search/m-p/135898#M27987 <P>Hi Sanjay,</P> <P>If I can I don't know how to.</P> Thu, 12 Feb 2015 09:27:13 GMT julianglavey 2015-02-12T09:27:13Z https://community.splunk.com/t5/Getting-Data-In/How-to-use-fields-from-different-source-types-in-the-same-search/m-p/135896#M27985 <P>Hi all,</P> <P>I am looking to try and figure out how to compose a query that has information I need in two distinct sourcetypes with potentially no shared field. The query is to figure out who launched a AWS EC2 instance that is not tagged correctly.</P> <P>I can find the instance launched details using this query.</P> <PRE><CODE>index=* sourcetype="ec2-audit" earliest_time=-1h instance_id=* NOT tag_Service="Self" | where isnull(tag_Opco) OR isnull(tag_Environment) OR isnull(tag_Cartesis) OR isnull(tag_Requester) OR isnull(tag_Service) OR isnull(tag_Product) OR isnull(tag_Role) OR isnull(tag_Username) OR isnull(tag_GST) | dedup instance_id | table index status type instance_id tag_Name tag_Environment tag_Service tag_Opco tag_Cartesis tag_Product tag_Role tag_Requester tag_Username tag_GST </CODE></PRE> <P>The problem is this source type does not contain any information around the user who is logged into the AWS console, and subsequently launched the instance. That is found using this querying <CODE>index=cloudtrail sourcetype=aws-cloudtrail</CODE>, which has a object <CODE>userIdentity.arn</CODE> which matches the person who launched the instance.</P> <P>So I know this is quite vague, but any is greatly appreciated</P> <P>Julian</P> Wed, 11 Feb 2015 17:28:39 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-use-fields-from-different-source-types-in-the-same-search/m-p/135896#M27985 julianglavey 2015-02-11T17:28:39Z https://community.splunk.com/t5/Getting-Data-In/How-to-use-fields-from-different-source-types-in-the-same-search/m-p/135897#M27986 <P>Can you correlate with time?</P> Wed, 11 Feb 2015 17:45:17 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-use-fields-from-different-source-types-in-the-same-search/m-p/135897#M27986 sanjay_shrestha 2015-02-11T17:45:17Z https://community.splunk.com/t5/Getting-Data-In/How-to-use-fields-from-different-source-types-in-the-same-search/m-p/135898#M27987 <P>Hi Sanjay,</P> <P>If I can I don't know how to.</P> Thu, 12 Feb 2015 09:27:13 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-use-fields-from-different-source-types-in-the-same-search/m-p/135898#M27987 julianglavey 2015-02-12T09:27:13Z