topic question regarding correlating two different device logs in Splunk Search

question regarding correlating two different device logs

somu2014 — Fri, 13 Jun 2014 07:50:33 GMT

hiii

we are having waf and ids the ip passes from ids and waf so i need to correlate the ip address and name fields in both devices... give me some example query regarding this

we have two device like waf and ids in this we

what i need is common ip address in both devices
source address waf signature of waf source address of ids signature of ids

Re: question regarding correlating two different device logs

aweitzman — Mon, 28 Sep 2020 16:51:16 GMT

Without knowing more details about your setup, the easiest way to do this is probably with a join. If the field names for source address and signature are the same in both (src_addr and sig in this example), you'll want to rename them so they don't overlap:

source=waf | rename src_addr as src_addr_waf, sig as sig_waf | join ip_addr [search source=ids | rename src_addr as src_addr_ids, sig as sig_ids] | table ip_addr src_addr_waf sig_waf src_addr_ids sig_ids

There are limitations to the number of results you can get back from a subsearch (the search in the brackets) that defaults to 50,000, so you'll want to either (a) make sure you have a small enough timeframe where that won't occur, or (b) change your limits.conf file to allow for more. See this page for a description of the limitations in the bottom section:

http://docs.splunk.com/Documentation/Splunk/6.1.1/Search/Aboutsubsearches#Result_output_settings_for_subsearch_commands

Re: question regarding correlating two different device logs

somu2014 — Tue, 17 Jun 2014 07:35:08 GMT

Thank you for ur answer and i also have one question

we have two log files one is ids logs and another is waf

we want to check for source address which are common in both ids and waf once we get that list that list of sources which are common in ids and waf we need the list of signature for those sources from both ids and waf

expected output:: src adress is comman in both ids and waf

srcaddress , sig of ids, sig of waf

Re: question regarding correlating two different device logs

aweitzman — Tue, 17 Jun 2014 13:33:44 GMT

It's a similar answer to above:

source=waf | rename sig as sig_waf | join src_addr [search source=ids | rename sig as sig_ids] | table src_addr sig_ids sig_waf

Use the common field as the field to join on (in this case src_addr) and do the same search on both sources, renaming any output fields that are the same in both so you know which one is which. Then create a table with the common field and any of your output fields.

Read up on the join command here:

http://docs.splunk.com/Documentation/Splunk/6.1.1/SearchReference/Join