topic I have a common field name for different sources. How do I view results from one source for this particular field name? in Getting Data In

I have a common field name for different sources. How do I view results from one source for this particular field name?

rashid47010 — Mon, 24 Oct 2016 15:47:55 GMT

I have common signature fields for both devices (Palo Alto and McAfee IPS) in the results. I just want to see the results from McAfee IPS signature filed.

Please advise.

Re: I have a common field name for different sources. How do I view results from one source for this particular field name?

somesoni2 — Mon, 24 Oct 2016 15:50:17 GMT

Both logs should have different sourcetype, so add mcafee IP specific sourcetype in your search (you can see the available sourcetypes of left field sidebar when you run the search).

Re: I have a common field name for different sources. How do I view results from one source for this particular field name?

rashid47010 — Tue, 29 Sep 2020 11:32:14 GMT

thanks for quick reply, below is my query:

index=paloalto_pa OR index=mcafee_ips src="2xx.xx.x.x1" | transaction src | stats count as "TOTAL_ATTEMPTS",values(dest) as DESTINATION,values(dest_translated_ip) as NATED_IP,values(threat_name),values(signature) by src

for paloalto and mcafee IPS i have common signature field. For paloalto the thread_name(paloalto) gives me more value instead showing signature.
now for mcafee IPS there is only signature field which is OK for me. now the results showing only signature field from paloalto not from mcafee IPS

Re: I have a common field name for different sources. How do I view results from one source for this particular field name?

gcusello — Mon, 24 Oct 2016 16:09:34 GMT

Use
index=your_index sourcetype=ips | ...
Bye.
Giuseppe

Re: I have a common field name for different sources. How do I view results from one source for this particular field name?

rashid47010 — Mon, 24 Oct 2016 16:17:56 GMT

I got my required results.
at this stage two things in my mind.

1- for singature filed it shows me the signature values from both index/sourcetypes. I want to see the signature from only mcafee IPS

2- how can I show the result where as both devices have different field name for result

Re: I have a common field name for different sources. How do I view results from one source for this particular field name?

aaraneta_splunk — Fri, 02 Dec 2016 03:46:15 GMT

@rashid47010 - Just to clarify: Did cusello's suggestion of using index=your_index sourcetype=ips | ... help get the "required results" to answer your question?