https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-search-2-different-IP-fields-rare-limits-to/m-p/183797#M52910 <P>Hi </P> <P>I was wondering if it was possible to search 2 different field's limits. I have tried using join, append, set diff and none have gotten me what I want. What I need is to be able to compare the rare limits of the field <CODE>ip_source</CODE> and the field <CODE>ip_destination</CODE> such that I can graph them both and see if any ip addresses overlap. </P> <P>This is my most recent search: </P> <PRE><CODE>set diff [search host="intern-Studio-1737" | rare limit=20 ip_destination] [search host="intern-Studio-1737" | rare limit=20 ip_source ] </CODE></PRE> <P>Please let me know if you can help!</P> Tue, 30 Jun 2015 14:14:54 GMT BITSIntern 2015-06-30T14:14:54Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-search-2-different-IP-fields-rare-limits-to/m-p/183797#M52910 <P>Hi </P> <P>I was wondering if it was possible to search 2 different field's limits. I have tried using join, append, set diff and none have gotten me what I want. What I need is to be able to compare the rare limits of the field <CODE>ip_source</CODE> and the field <CODE>ip_destination</CODE> such that I can graph them both and see if any ip addresses overlap. </P> <P>This is my most recent search: </P> <PRE><CODE>set diff [search host="intern-Studio-1737" | rare limit=20 ip_destination] [search host="intern-Studio-1737" | rare limit=20 ip_source ] </CODE></PRE> <P>Please let me know if you can help!</P> Tue, 30 Jun 2015 14:14:54 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-search-2-different-IP-fields-rare-limits-to/m-p/183797#M52910 BITSIntern 2015-06-30T14:14:54Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-search-2-different-IP-fields-rare-limits-to/m-p/183798#M52911 <P>Try this:</P> <PRE><CODE>[search host="intern-Studio-1737" | rare limit=20 ip_destination | eval joiner=ip_destination] | append [search host="intern-Studio-1737" | rare limit=20 ip_source | eval joiner=ip_source ] | stats values(*) AS * by joiner </CODE></PRE> <P>This will give you the fields from the events in each source that share the same IP address and drop all the other events' fields.</P> Tue, 30 Jun 2015 14:24:36 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-search-2-different-IP-fields-rare-limits-to/m-p/183798#M52911 woodcock 2015-06-30T14:24:36Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-search-2-different-IP-fields-rare-limits-to/m-p/183799#M52912 <P>Hello! Did you use the <STRONG>join</STRONG> like this?</P> <PRE><CODE> ...... host="intern-Studio-1737" | rare limit=20 ip_destination|join [search host="intern-Studio-1737" | rare limit=20 ip_source ]|table ip_destination ip_source </CODE></PRE> Tue, 30 Jun 2015 14:26:52 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-search-2-different-IP-fields-rare-limits-to/m-p/183799#M52912 stephanefotso 2015-06-30T14:26:52Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-search-2-different-IP-fields-rare-limits-to/m-p/183800#M52913 <P>THANK YOU!</P> Tue, 30 Jun 2015 14:31:00 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-search-2-different-IP-fields-rare-limits-to/m-p/183800#M52913 BITSIntern 2015-06-30T14:31:00Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-search-2-different-IP-fields-rare-limits-to/m-p/183801#M52914 <P>Thanks for the help! This didn't really get me the result I wanted but it helped!</P> Tue, 30 Jun 2015 14:31:29 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-search-2-different-IP-fields-rare-limits-to/m-p/183801#M52914 BITSIntern 2015-06-30T14:31:29Z