https://community.splunk.com/t5/Getting-Data-In/What-is-the-most-efficient-way-to-correlate-fields-from/m-p/289176#M55197 <P>I have some vulnerability and asset data I need to correlate but I am not sure of the best method to use...</P> <PRE><CODE>index=rapid7 sourcetype="rapid7:nexpose:asset" | stats values(os) values(hostname) by asset_id 1234 Microsoft blah some_asset_name.corp.com 1235 Linux blah some_asset_name.corp.com index=rapid7 sourcetype="rapid7:nexpose:vuln" "some vuln of interest" | stats values(signature) values(solution_summary) by asset_id 1234 signature_value allows this blah blah attack solution_summary_value disable blah bah 1235 signature_value allows this blah blah attack solution_summary_value disable blah bah </CODE></PRE> <P>The two queries give me values based on the asset_id number, I just need a fast way to correlate the queries so I can report </P> <PRE><CODE>os hostname signature solution_summary asset_id </CODE></PRE> <P>Any advice appreciated.</P> <P>Thank you</P> Thu, 24 Aug 2017 18:59:32 GMT packet_hunter 2017-08-24T18:59:32Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-most-efficient-way-to-correlate-fields-from/m-p/289176#M55197 <P>I have some vulnerability and asset data I need to correlate but I am not sure of the best method to use...</P> <PRE><CODE>index=rapid7 sourcetype="rapid7:nexpose:asset" | stats values(os) values(hostname) by asset_id 1234 Microsoft blah some_asset_name.corp.com 1235 Linux blah some_asset_name.corp.com index=rapid7 sourcetype="rapid7:nexpose:vuln" "some vuln of interest" | stats values(signature) values(solution_summary) by asset_id 1234 signature_value allows this blah blah attack solution_summary_value disable blah bah 1235 signature_value allows this blah blah attack solution_summary_value disable blah bah </CODE></PRE> <P>The two queries give me values based on the asset_id number, I just need a fast way to correlate the queries so I can report </P> <PRE><CODE>os hostname signature solution_summary asset_id </CODE></PRE> <P>Any advice appreciated.</P> <P>Thank you</P> Thu, 24 Aug 2017 18:59:32 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-most-efficient-way-to-correlate-fields-from/m-p/289176#M55197 packet_hunter 2017-08-24T18:59:32Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-most-efficient-way-to-correlate-fields-from/m-p/289177#M55198 <P>I came up with...</P> <PRE><CODE>index=rapid7 sourcetype="rapid7:nexpose:asset" OR sourcetype="rapid7:nexpose:vuln" [search index=rapid7 sourcetype="rapid7:nexpose:vuln" TLS 1.0 | fields asset_id] |stats values(hostname) values(os) values(signature) values(solution_summary) by asset_id </CODE></PRE> <P>any other ideas on this?</P> Thu, 24 Aug 2017 19:54:22 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-most-efficient-way-to-correlate-fields-from/m-p/289177#M55198 packet_hunter 2017-08-24T19:54:22Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-most-efficient-way-to-correlate-fields-from/m-p/289178#M55199 <P>This should be just slightly more efficient than that ...</P> <PRE><CODE>index=rapid7 (sourcetype="rapid7:nexpose:asset" OR (sourcetype="rapid7:nexpose:vuln" "some vuln of interest") ) | stats values(hostname) as hostname, values(os) as os, values(signature) as signature, values(solution_summary) as solution_summary values(sourcetype) as sourcetype by asset_id | where mvcount(sourcetype)&gt;1 </CODE></PRE> <P>Coded this way, it only has to search the index for the <CODE>vuln</CODE> <CODE>sourcetype</CODE> once. However, if you have a large number of <CODE>os</CODE> records, relative to <CODE>vuln</CODE> records, then your way will be more efficient.</P> Thu, 24 Aug 2017 20:17:36 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-most-efficient-way-to-correlate-fields-from/m-p/289178#M55199 DalJeanis 2017-08-24T20:17:36Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-most-efficient-way-to-correlate-fields-from/m-p/289179#M55200 <P>yes this is faster... <BR /> Thank you</P> Fri, 25 Aug 2017 14:33:32 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-most-efficient-way-to-correlate-fields-from/m-p/289179#M55200 packet_hunter 2017-08-25T14:33:32Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-most-efficient-way-to-correlate-fields-from/m-p/289180#M55201 <P>When theory matches performance, believe performance. </P> <P>When theory does NOT match performance, believe performance.</P> Fri, 25 Aug 2017 16:26:02 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-most-efficient-way-to-correlate-fields-from/m-p/289180#M55201 DalJeanis 2017-08-25T16:26:02Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-most-efficient-way-to-correlate-fields-from/m-p/289181#M55202 <P>In a similar vein, I am stuck on getting values returned as intended. I am trying to get riskscore values for assets that have an exception applied, but only the exception values of risk. </P> <P>Something like this, but I am unclear how to differentiate the risk:<BR /> index=rapid7 | transaction asset_id | makemv nexpose_tags delim=";" | stats sum(riskscore) as totalrisk, values(review_comment), values(submitted_by) by nexpose_tags | eval totalrisk=round(totalrisk) | sort -totalrisk</P> <P>Perhaps some version of your query above would fit into this query to show the asset group and its risk that is being excluded in Nexpose?</P> Tue, 29 Sep 2020 17:21:49 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-most-efficient-way-to-correlate-fields-from/m-p/289181#M55202 ranich 2020-09-29T17:21:49Z