topic Re: Search field in 2 index in Splunk Search

How to search field in two indexes?

shashilendraman — Thu, 23 Mar 2023 14:37:31 GMT

how to search value of "Dst_IP" field from "ASA" index to "otx" index "indicator" field and display the scrip" field from "ASA" index.

Re: Search field in 2 index

gcusello — Thu, 23 Mar 2023 12:14:03 GMT

hi @shashilendraman ,

let me understand:

you want to filter the "ASA" index events using the events from the "otx" index, using as correlation key the fields "Dst_IP" field from "ASA" and the "indicator" field from "otx" index; then you want to display the "scrip" field from "ASA" index, is it correct?

if this is your requirement, please try this:

Ciao.

Giuseppe

Re: Search field in 2 index

shashilendraman — Fri, 24 Mar 2023 03:57:34 GMT

yes , you correct , but i am not getting desire output.

i am attaching ASA index output , otx index output and Correlation SPL which i prepared as you suggested.Correlation SPL

Re: Search field in 2 index

shashilendraman — Fri, 24 Mar 2023 04:07:47 GMT

ASA

Re: How to search field in two indexes?

shashilendraman — Fri, 24 Mar 2023 06:23:48 GMT

Hi Gcusello,

output is blank for below query.

index=*asa* [search index=otx sourcetype="otx:indicator" type=IPv4 indicator=* |rename indicator as dst_ip|fields dst_ip]|dedup src_ip|table src_ip.

how ever i manually ping/trace 1 ip address which is in indicator field for testing purpose and i can see those IP in ASA logs in splunk.

Thanks

shashi

Re: How to search field in two indexes?

gcusello — Fri, 24 Mar 2023 10:35:18 GMT

Hi @shashilendraman,

manually run the subsearch, them manually use the results in the main search and analyze them to understand if results are compatible with the main search (e.g. format, or message, etc...) and if the search must have results.

Ciao.

Giuseppe