topic Re: Combine multiple search fields in Splunk Search

Combine multiple search fields

jbanAtSplunk — Tue, 26 Apr 2022 15:47:54 GMT

Hi,

We have a scenario where we have three different events that should combine together based on Event ID.

Example

Event 1 Fields:

Hostname
Unique_ID
Has_Vulnerabilities

Event 2 Fields:

Scan_Date
Hostname_Unique_ID
Vulnerability_Id

Event 3 Fields:

Vulnerability_id
Description
Start_Date
…

What we are trying to do is, when I click on “Event 1 Unique_ID” to get all Vulnerabilities for Selected Host for “Event 2” enriched with selected data from “Event 3”.

All three events are in the same index but different sourcetype.

What is the best approach here? Subsearch seems slow If I go “Event 2” first and then filter to “Event 1”. I want another way around.

Re: Combine multiple search fields

isoutamo — Tue, 26 Apr 2022 15:54:33 GMT

Can you clarify if you want an dashboard (as you are talking about clicks) and drill down to those events by individual hosts or do you want one query which contains all that info?

I suppose that Hostname == Hostname_Unique_ID or is there some other field on event 1 to match those?

r. Ismo

Re: Combine multiple search fields

jbanAtSplunk — Tue, 26 Apr 2022 15:58:34 GMT

Eventually I will create dashboard. For now, search is enough just to get me going 🙂

we can use hostname=hostname_unique_id