Archive

searching across multiple indexes with lookups

we have two indexes with some overlap in fields. specifically IP addresses. what I would like to is do an initial search dedup all the dest_ips then in the same search string use the deduped list of IPs as the filter on the second index. Is this possible? I would think some type of lookup table is the way to go.

Tags (1)
0 Karma

SplunkTrust
SplunkTrust

Hi,

Can you please try something like this?

index=<index 1> [search index=<index 2> | dedup dest_ip| return dest_ip]

does this return all the events in index one that have a destip that exists in the list of destips returned from index 2?

0 Karma

SplunkTrust
SplunkTrust

This will display destip which are in Index 2 and then AND with index 1 destip

So this query works like this index= index 1 AND dest_IP from Index 2

0 Karma

It depends on the size of the result set and the frequency with which you'll run this. If you want to save the results of that first deduped query to use over and over, the lookup file would be a good way to go:

index=first_index
| stats values(dest_ip) AS dest_ip
| outputlookup ip_list

And then to use it in your subsequent searches:

index=second_index 
[ | inputlookup ip_list 
  | stats values(dest_ip) AS dest_ip 
  | format ]

If it's just an ad-hoc thing you want to run once, you are likely fine with a single subsearch:

index=second_index
[ search index=first_index
  | stats values(dest_ip) AS dest_ip
  | format ]