topic Re: How to join fields from other index with comparing fields in Splunk Search

How to join fields from other index with comparing fields

ykwon7 — Wed, 30 Sep 2020 05:08:16 GMT

Hello,

Cloud you give me some tips.

Search Query S1
index=S1
| bla bla bla
| stats value(dstIP) value(dstPort) value(srcIP) value(srcUser) by URL

In S1's results, I want to add "sum(Byte)", Byte is in S2.
Also S2's log has dstIP, dstPort and Byte.
From comparing S1_dstIP with S2_dstIP, I want to add "sum(Byte)" on the search result.

Re: How to join fields from other index with comparing fields

to4kawa — Sat, 25 Apr 2020 00:10:43 GMT

index=S1 OR index=S2
| eval key=dstIP."_".dstPort."_".srcIP."_".srcPort."_".srcUser
| stats values(URL) as URL sum(Byte) as Bytes by key
| rex field=key "(?<dstIP>.*?)_(?<dstPort>.*?)_(?<srcIP>.*?)_(?<srcPort>.*?)_(?<srcUser>.*)"
| table URL Bytes dstIP dstPort srcIP srcUser
| where isnotnull(URL)

see reference: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Stats

Re: How to join fields from other index with comparing fields

ykwon7 — Mon, 27 Apr 2020 01:31:38 GMT

S1's log ={dstIP, dstPort, srcIP,srcPort, srcUser, URL}
S2's log ={dstIP, dstPort, srcIP,srcPort, srcUser, Bytes}

Result = dstIP, dstPort, srcIP,srcPort, srcUser, sum(Bytes) by URL

So then, I think it needs to be joined by comparing dstIP, dstPort