topic coorelated event in Splunk Search

coorelated event

rashid47010 — Thu, 20 Oct 2016 05:27:20 GMT

any body advise me why the below query is not showing the the IP's whereas I am sure that there are some IP's who are bluecoat logs but not in websense logs:

index=websense sourcetype=websense src NOT [search index=bcoat sourcetype="bluecoat:proxysg:access:file" | fields src ]

Re: coorelated event

gokadroid — Thu, 20 Oct 2016 05:52:49 GMT

Isn't that your query is doing exactly opposite:

Search IPs in websense log which are NOT in [ IPs in bluecoat logs]

Shouldn't you be doing below if you want *some IP's who are bluecoat logs but not in websense logs:
*:

Search IPs in bluecoat logs NOT in [ IPs in websense logs ]

Re: coorelated event

gcusello — Thu, 20 Oct 2016 08:15:49 GMT

To troubleshot your search start to try your single searches separately and see if there are values in both of them and values that aren't in both of them.

index=websense sourcetype=websense src
index=bcoat sourcetype="bluecoat:proxysg:access:file" | fields src

In addition, verify that the field src is present in both the searches?

The string "src" that you put before "NOT" means that in the first search you want to search also the word "src" or other?

Bye.
Giuseppe

Re: coorelated event

rashid47010 — Thu, 20 Oct 2016 08:33:22 GMT

the src field is common for both devices. and I check the logs individually. I have one use case that for sure he is bypassing websense control(means there are no logs on websense for that src IP)

but still now showing any result:
my query is :

index=websense sourcetype=websense NOT [search index=bcoat sourcetype="bluecoat:proxysg:access:file" | fields src ]

Re: coorelated event

rashid47010 — Thu, 20 Oct 2016 08:35:51 GMT

I am trying now with this query.
shortly I will update you with the results.

index=bcoat sourcetype="bluecoat:proxysg:access:file" NOT [search index=websense | fields src ]

Re: coorelated event

gcusello — Thu, 20 Oct 2016 08:43:06 GMT

does your search run without "NOT"? what result you have?
Bye.
Giuseppe