Query question between 2 indexes

christay — Mon, 06 Jul 2020 08:11:38 GMT

Hi Guys,

Can i check how can i craft the query given the following condition.

I have 2 indexes IndexA and IndexB with the following filed in each index.

Example as follows :

IndexA

Field contains :

srcIP = 10.10.10.10
cat = malicious IP 100%

IndexB

Field contains :

TrueClientIP = 10.10.10.10

The objective of my query is to compare "TrueClientIP" under Index B against "srcIP" under IndexA and the condition that if the "cat" field under IndexA is tag under malicious IP it will return me the count .

How can i craft the above query ?

Thanks for the help.

Re: Query question between 2 indexes

to4kawa — Mon, 06 Jul 2020 08:28:42 GMT

index=IndexA OR index=IndexB | eval ip=coalesce(srcIP,TrueClientIP) | rex field=cat "(?<malicious>malicious)" | stats count(malicious) by ip

topic Query question between 2 indexes in Splunk Search

Query question between 2 indexes

Re: Query question between 2 indexes