Dashboards & Visualizations

Highlighting data in one table that is contained in a separate table?

mjande5
Observer

Hi, rather new to this community, but trying to figure this out.  I have table 1 with two fields, (src_ip and dest_ip) and another table 2 with (IP) field.  I would like to highlight any IPs in table 2 that are a match to any in table 1 in either field.  Is there an easy way to accomplish this?  Thanks in advance.

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Since you're asking in the "Dashboards & Visualizations" section - do you mean that you have two separate table widgets on the same  dashboard? Or do you simply want to do a "match" for two given searches.

0 Karma

mjande5
Observer

@PickleRick 

Sorry, I should have been more clear.  I have two separate dashboards that query differing information.  One has src_ip and dest_ip columns and the other dashboard has an IP column.  I would like to have any IPs in either the src_ip or dest_ip columns to highlight or some way stand out if they match the IPs in the other dashboard with the IP column.  I hope this helps clear up what I am trying to do.

-Mike

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mjande5,

if the results in the second table are less than 50,000, you can use a search like this:

index=index1 ([ search index=index2 | rename IP AS src_ip | fields src_ip ] OR [ search index=index2 | rename IP AS dest_ip | fields dest_ip ])
| table _time src_ip dest_ip

If they are more than 50,000 you need a different solution.

Let me know.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...