Archive

coorelated event

Communicator

any body advise me why the below query is not showing the the IP's whereas I am sure that there are some IP's who are bluecoat logs but not in websense logs:

index=websense sourcetype=websense src NOT [search index=bcoat sourcetype="bluecoat:proxysg:access:file" | fields src ]

Tags (1)
0 Karma

SplunkTrust
SplunkTrust

To troubleshot your search start to try your single searches separately and see if there are values in both of them and values that aren't in both of them.

  • index=websense sourcetype=websense src
  • index=bcoat sourcetype="bluecoat:proxysg:access:file" | fields src

In addition, verify that the field src is present in both the searches?

The string "src" that you put before "NOT" means that in the first search you want to search also the word "src" or other?

Bye.
Giuseppe

0 Karma

Communicator

the src field is common for both devices. and I check the logs individually. I have one use case that for sure he is bypassing websense control(means there are no logs on websense for that src IP)

but still now showing any result:
my query is :

index=websense sourcetype=websense NOT [search index=bcoat sourcetype="bluecoat:proxysg:access:file" | fields src ]

0 Karma

SplunkTrust
SplunkTrust

does your search run without "NOT"? what result you have?
Bye.
Giuseppe

0 Karma

Motivator

Isn't that your query is doing exactly opposite:

Search IPs in websense log which are NOT in [ IPs in bluecoat logs]

Shouldn't you be doing below if you want *some IP's who are bluecoat logs but not in websense logs:
*
:

Search IPs in bluecoat logs NOT in [ IPs in websense logs ]
0 Karma

Communicator

I am trying now with this query.
shortly I will update you with the results.

index=bcoat sourcetype="bluecoat:proxysg:access:file" NOT [search index=websense | fields src ]

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!