Highlighting data in one table that is contained in a separate table?

[mjande5]

Hi, rather new to this community, but trying to figure this out.  I have table 1 with two fields, (src_ip and dest_ip) and another table 2 with (IP) field.  I would like to highlight any IPs in table 2 that are a match to any in table 1 in either field.  Is there an easy way to accomplish this?  Thanks in advance.

[PickleRick]

Since you're asking in the "Dashboards & Visualizations" section - do you mean that you have two separate table widgets on the same  dashboard? Or do you simply want to do a "match" for two given searches.

[mjande5]

@PickleRick 

Sorry, I should have been more clear.  I have two separate dashboards that query differing information.  One has src_ip and dest_ip columns and the other dashboard has an IP column.  I would like to have any IPs in either the src_ip or dest_ip columns to highlight or some way stand out if they match the IPs in the other dashboard with the IP column.  I hope this helps clear up what I am trying to do.

-Mike

[gcusello]

Hi @mjande5,

if the results in the second table are less than 50,000, you can use a search like this:

index=index1 ([ search index=index2 | rename IP AS src_ip | fields src_ip ] OR [ search index=index2 | rename IP AS dest_ip | fields dest_ip ])
| table _time src_ip dest_ip

If they are more than 50,000 you need a different solution.

Let me know.

Ciao.

Giuseppe