topic Re: Show only matching IP's from two different fields in Splunk Search

Show only matching IP's from two different fields

sbattista09 — Sat, 31 Jan 2015 00:28:03 GMT

base search would be: index=index1 host=scan1 OR host=scan2

In the scans there are fields that are named differently but have Ip address in them, I would like Splunk to take the two fields and show me only the IP's that appear in both of them and get a total count. The names of the fields are IPAddressText and IPHost. I hope there is a simple eval statement someone could help me with.

thanks!

Re: Show only matching IP's from two different fields

_d_ — Sat, 31 Jan 2015 02:03:58 GMT

See if this works for you:

index=index1 host=scan1 OR host=scan2 PAddressText=* IPHost=* | where IPAddressText=IPHost

Re: Show only matching IP's from two different fields

sbattista09 — Sat, 31 Jan 2015 02:47:12 GMT

sorry, it did not work. its seems to be having trouble searching between the two fields. I say this because I ran just the index=index1 host=scan1 OR host=scan2 PAddressText=* IPHost=* part and nothing came up until i put a OR between the PAddressText=* IPHost=*.

Re: Show only matching IP's from two different fields

sbattista09 — Thu, 19 Feb 2015 20:38:28 GMT

not sure if the will make sense but, i built it out a little differently and it works, i named the fileds in the CSV's the same that i need to compare counts-

thanks for the help guys.