topic Re: Consolidation From Different Sources in Splunk Search

Consolidation From Different Sources

Cyber_Nerd3 — Mon, 23 Aug 2021 14:02:43 GMT

Hey Everyone!

I'm in need of some help, advice, Ouija board (lol)...whatever can do the trick. I am wanting to know if it is possible to consolidate data from a search that is not generated on Splunk? My supervisor is wanting to receive 1 report instead of 2. Do any of you know if this is even possible?

Thanks,

Cyber_Nerd3

Re: Consolidation From Different Sources

richgalloway — Mon, 23 Aug 2021 14:23:02 GMT

Please tell us more about the use case. Where is the other data generated? Is this other source integrated with Splunk?

Re: Consolidation From Different Sources

ITWhisperer — Mon, 23 Aug 2021 14:24:08 GMT

Ingest the data or report from the other search into splunk and produce one report from splunk (or tell you supervisor to "man up" and deal with two reports! lol 😀)

Re: Consolidation From Different Sources

Cyber_Nerd3 — Mon, 23 Aug 2021 15:28:26 GMT

Lol, Thank you so much!

Re: Consolidation From Different Sources

Cyber_Nerd3 — Mon, 23 Aug 2021 16:35:19 GMT

Ok @ITWhisperer & @richgalloway I just got clarification on everything and what he wants is to combine multiple reports located within Splunk into 1 report. I apologize for the misunderstanding on my part, but if either of you could give any input on how to achieve this it would be greatly appreciated.

Thank you!

Re: Consolidation From Different Sources

richgalloway — Mon, 23 Aug 2021 16:39:53 GMT

We need to know more about the two reports. How similar are they? What searches do they use?

In principle, two reports can be combined, but exactly to do that depends heavily on the reports themselves. There is no generic answer.

Re: Consolidation From Different Sources

Cyber_Nerd3 — Mon, 23 Aug 2021 16:55:29 GMT

4 are firewall logs which need to be combined into 1 report and the other 2 are just Windows reports.

I hope this helps,

Thanks

Re: Consolidation From Different Sources

richgalloway — Tue, 24 Aug 2021 00:01:59 GMT

Yeah, not really, other than to confirm my "maybe" response.

Search these forums (Google works well) for "combine searches" and you should get a lot of good examples both of how to ask this question and how to solve it.