Splunk Search

How to compare fields from two different event types

corwinz6
Explorer

Hello,

I am trying to come up with a search to compare the IP address values from two different log types contained in the same sourcetype. i.e. sourcetype=firewall (type=traffic AND status!=deny) Grab src and compare to src in (type=emailfilter AND blacklist)

I would then chart values that aren't denied in traffic but are blacklisted in a table showing the top 10.

How/is it possible to compare the src field in the traffic log to the src field in the email log if the above conditions are true?

Thanks

Tags (1)
0 Karma
1 Solution

Johnvey
Contributor

It sounds like you're trying to do an intersection of the following 2 searches:

(1)  sourcetype=firewall (type=traffic AND status!=deny)
(2)  sourcetype=firewall (type=emailfilter AND blacklist)

If that's true, then you can use stats to identify a field value for src that appears in both searches:

sourcetype=firewall (type=traffic AND status!=deny) OR (type=emailfilter AND blacklist) | stats count dc(type) as type_count by src | where type_count > 1 | sort count desc | head 10

This search assumes that the two searches actually produce mutually exclusive sets.

View solution in original post

Johnvey
Contributor

It sounds like you're trying to do an intersection of the following 2 searches:

(1)  sourcetype=firewall (type=traffic AND status!=deny)
(2)  sourcetype=firewall (type=emailfilter AND blacklist)

If that's true, then you can use stats to identify a field value for src that appears in both searches:

sourcetype=firewall (type=traffic AND status!=deny) OR (type=emailfilter AND blacklist) | stats count dc(type) as type_count by src | where type_count > 1 | sort count desc | head 10

This search assumes that the two searches actually produce mutually exclusive sets.

corwinz6
Explorer

Thanks, that looks to be working great. What prevents it from incrementing type_count when more than one event gets generated for (type=traffic AND status!=deny)with the same src value but no (type=emailfilter AND blacklist)?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...