https://community.splunk.com/t5/Splunk-Search/Correlating-Data-from-2-Indexes/m-p/545627#M154595 <P>I have 2 indexes, one called <STRONG>linux</STRONG> and another called <STRONG>firewall</STRONG>, how can I correlate both indexes to determine if the <STRONG>src field</STRONG> (of the <STRONG>linux</STRONG> index) is equal to the <STRONG>UserIP</STRONG> field (of the <STRONG>firewall</STRONG> index)</P><P>&nbsp;</P> Fri, 26 Mar 2021 15:55:04 GMT splunkcol 2021-03-26T15:55:04Z https://community.splunk.com/t5/Splunk-Search/Correlating-Data-from-2-Indexes/m-p/545627#M154595 <P>I have 2 indexes, one called <STRONG>linux</STRONG> and another called <STRONG>firewall</STRONG>, how can I correlate both indexes to determine if the <STRONG>src field</STRONG> (of the <STRONG>linux</STRONG> index) is equal to the <STRONG>UserIP</STRONG> field (of the <STRONG>firewall</STRONG> index)</P><P>&nbsp;</P> Fri, 26 Mar 2021 15:55:04 GMT https://community.splunk.com/t5/Splunk-Search/Correlating-Data-from-2-Indexes/m-p/545627#M154595 splunkcol 2021-03-26T15:55:04Z https://community.splunk.com/t5/Splunk-Search/Correlating-Data-from-2-Indexes/m-p/545631#M154599 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/223770">@splunkcol</a>,</P><P>let me understand: you have two indexes and you want to list all the IPs in both the archives indicanding if they are present in both or only in one, is it correct?</P><P>if this is your need, you could run something like this:</P><LI-CODE lang="markup">index=linux OR index=firewall | eval ip=coalesce(src,UserIP) | stats dc(index) AS dc_index values(index) AS index BY ip | eval status=if(dc_index=2,"Both indexes",if(index="linux","Linux Index","Firewall Index")) | sort ip | table ip status</LI-CODE><P>Ciao.</P><P>Giuseppe</P><P>&nbsp;</P> Fri, 26 Mar 2021 16:12:46 GMT https://community.splunk.com/t5/Splunk-Search/Correlating-Data-from-2-Indexes/m-p/545631#M154599 gcusello 2021-03-26T16:12:46Z https://community.splunk.com/t5/Splunk-Search/Correlating-Data-from-2-Indexes/m-p/546133#M154795 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/223770">@splunkcol</a>,</P><P>good for you, see next time!</P><P>Ciao and happy splunking.</P><P>Giuseppe</P><P>P.S.: Karma Points are appreciated <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Wed, 31 Mar 2021 06:31:26 GMT https://community.splunk.com/t5/Splunk-Search/Correlating-Data-from-2-Indexes/m-p/546133#M154795 gcusello 2021-03-31T06:31:26Z