topic Re: Correlation 2 sourcetype with common fields different name in Splunk Search

Correlation 2 sourcetype with common fields different name

pgbr7 — Tue, 29 Sep 2020 23:25:10 GMT

Hello guys,

I have 2 sourcetype, the sourcetype A have the fields [ IP , hostname , source_mac ] , the sourcetype B have the fields [ Username , mac_addres ]
I need a correlation the sourcetype A source_mac with sourcetype B mac_addres, because it's the same MAC.
Return table with fields [ Username , mac_addres, IP ,hostname ]

I'm trying this:

But don't work, return the sourcetype=A and sourcetype=B.

Any suggestion ?

Re: Correlation 2 sourcetype with common fields different name

lakshman239 — Tue, 29 Sep 2020 23:25:12 GMT

You would need to use join as mentioned by another splunker.

Re: Correlation 2 sourcetype with common fields different name

cvssravan — Tue, 29 Sep 2020 23:20:45 GMT

try this if you are ok with using join

Re: Correlation 2 sourcetype with common fields different name

pgbr7 — Tue, 29 Sep 2020 23:25:41 GMT

In this case, In sourcetype"B" I have mac_addres, but in sourcetype="A" I don´t have . So I need
compare fields ( mac_addres and source_mac , If the Source_mac have the same mac_addres, i return the fields Sourcetype A ( IP , hostname ) and sourcetype B ( Username ) in the same table.

In this case:
index=main (sourcetype=A OR sourcetype=B)
| fields IP , hostname , source_mac , mac_address, Username
| search (mac_address == source_mac)
|table IP, hostname, source_mac, Username

Don´t work.

Thanks guys.

Re: Correlation 2 sourcetype with common fields different name

pgbr7 — Mon, 25 Feb 2019 14:06:50 GMT

Don´t work, Thanks.

Re: Correlation 2 sourcetype with common fields different name

FrankVl — Mon, 25 Feb 2019 14:20:13 GMT

The entries for each sourcetype would come in their own rows in the results, so doing search (mac_address == source_mac) will never work. Also search cannot be used to compare fields, you need to use where for that.

Re: Correlation 2 sourcetype with common fields different name

lakshman239 — Mon, 25 Feb 2019 14:41:46 GMT

Thx FrankVI

Re: Correlation 2 sourcetype with common fields different name

cvssravan — Tue, 29 Sep 2020 23:26:14 GMT

As you don't have source_mac in both source types, we are renaming mac_address in source type B to source_mac to facilitate join with source type A. Not sure why it didn't work.

Re: Correlation 2 sourcetype with common fields different name

pgbr7 — Wed, 27 Feb 2019 17:31:16 GMT

Sorry for the mistake. I test again and work. I forget the rename the field.

Thanks man.