https://community.splunk.com/t5/Splunk-Search/How-to-compare-data-from-data-model-with-data-from-data-set/m-p/631866#M219475 <P>Hello, I have a data model named&nbsp;<STRONG>firewall_logs&nbsp;</STRONG>with firewall data in which the interesting fields are: file_hash, url and source/dest IP.</P> <P>And I have a dataset named <STRONG>intel_indicators</STRONG>&nbsp;with column named <STRONG>ioc</STRONG> in which I have hashes, IPs, domains and timestamp.</P> <P>&nbsp;</P> <P>What I want to do is to compare the data (hashes, IPs, domains) from&nbsp;<STRONG>ioc</STRONG> column with the fields:&nbsp;<EM>file_hash, url, dest_ip.</EM> If there is a match, it should be visible.</P> <P>Any ideea how I can accomplish this ?</P> <P>&nbsp;</P> <P>| tstats summariesonly=t allow_old_summaries=t&nbsp; ...interesting fields.... from datamodel="firewall_logs"&nbsp; a</P> <P><EM>and here I'm stuck</EM></P> Wed, 22 Feb 2023 17:19:01 GMT danutmatei 2023-02-22T17:19:01Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-data-from-data-model-with-data-from-data-set/m-p/631866#M219475 <P>Hello, I have a data model named&nbsp;<STRONG>firewall_logs&nbsp;</STRONG>with firewall data in which the interesting fields are: file_hash, url and source/dest IP.</P> <P>And I have a dataset named <STRONG>intel_indicators</STRONG>&nbsp;with column named <STRONG>ioc</STRONG> in which I have hashes, IPs, domains and timestamp.</P> <P>&nbsp;</P> <P>What I want to do is to compare the data (hashes, IPs, domains) from&nbsp;<STRONG>ioc</STRONG> column with the fields:&nbsp;<EM>file_hash, url, dest_ip.</EM> If there is a match, it should be visible.</P> <P>Any ideea how I can accomplish this ?</P> <P>&nbsp;</P> <P>| tstats summariesonly=t allow_old_summaries=t&nbsp; ...interesting fields.... from datamodel="firewall_logs"&nbsp; a</P> <P><EM>and here I'm stuck</EM></P> Wed, 22 Feb 2023 17:19:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-data-from-data-model-with-data-from-data-set/m-p/631866#M219475 danutmatei 2023-02-22T17:19:01Z