topic Re: How do I search from 2 different indexes? in Splunk Search

How do I search from 2 different indexes?

ajayrejin — Wed, 20 Feb 2019 07:56:41 GMT

Hi,

How do I search in two indexes? I am looking for the IP address in both the indexes at that same point of time and correlate them.

One index is firewall and other index is Microsoft ATA.

Re: How do I search from 2 different indexes?

skoelpin — Wed, 20 Feb 2019 13:10:53 GMT

Like this

(index=A OR index=B)

Re: How do I search from 2 different indexes?

ajayrejin — Wed, 20 Feb 2019 13:51:29 GMT

Hi,
Okay.. That query would check either in A or B right.

What i am looking for here is, the IP is in both indexes and that IP is present in both indexes at the same time. I need to correlate them..
Ex: IP in index 1 is seen @ 12 PM, then same IP is also seen @ 12PM in index 2. How do i check this? If the IPs have seen @ same time.

Re: How do I search from 2 different indexes?

skoelpin — Wed, 20 Feb 2019 15:03:36 GMT

Yes correct, this will search both indexes. If you want to coorelate between both indexes, you can use the search below to get you started.

You will need to replace your index name and srcip with the field-name of your IP value.

(index=A OR index=B)
| stats count earliest(_time) as _time by srcip
| where count >=2

Re: How do I search from 2 different indexes?

ajayrejin — Fri, 22 Feb 2019 13:06:53 GMT

Thank you for the query. I tried that query, it gives me all the IPs from both the indexes. I wanted the common IP between the indexes

Re: How do I search from 2 different indexes?

vinod94 — Fri, 22 Feb 2019 15:30:09 GMT

Hi @ajayrejin ,

You can join command if if you have common field in both the indexes.

you can follow this doc for better reference.

https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/Join

or you can use transaction command

https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/Transaction

this might help you!

Re: How do I search from 2 different indexes?

ajayrejin — Mon, 25 Feb 2019 06:17:41 GMT

Hi,

There is no common field in both the indexes.