Dashboards & Visualizations

How to join where a macro is used in the search?

POR160893
Builder

Hi,

On Splunk, I have a macro called `ABC` . I use this macro in the first search like this:
`ABC`
| stats values(src_ip) values(src_zone) values(dest_ip) values(dest_port) values(app) values(transport) values(session_end_reason) by host rule action
| rename values(*) as *
| rex field=host "(?<host_new>[^\.]+?)(?:\.[01]|\.02)?\."
I also have a second Splunk search as follows:
| rex field=Device_FQDN "(?<Device_FQDN>[^\.]+?)(?:\.[01]|\.02)?\."
I need to JOIN BOTH searches using the field "host_new" from the first search and the field "Device_FQDN" from the second search as the common fields to perform the JOIN on.
What would the Splunk query be in this case, using both searches I have supplied and where the first search uses a macro?


Many thanks,
P

Labels (4)
0 Karma

TrangCIC81
Communicator

can you try something like this?

 

 

(index=<your_index> <your_first_search> | `ABC`
| stats values(src_ip) values(src_zone) values(dest_ip) values(dest_port) values(app) values(transport) values(session_end_reason) by host rule action
| rename values(*) as *
| rex field=host "(?<host_new>[^\.]+?)(?:\.[01]|\.02)?\.") 
| join host_new [| <your_second_search> | rex field=Device_FQDN "(?<Device_FQDN>[^\.]+?)(?:\.[01]|\.02)?\." | fields Device_FQDN host_new]

 

 Using the join command to join the first search with the second search.  

0 Karma

POR160893
Builder

I have already provided you with the first and second searches, though. The first search is:
`palo_logs(traffic)`
| stats values(src_ip) values(src_zone) values(dest_ip) values(dest_port) values(app) values(transport) values(session_end_reason) by host rule action
| rename values(*) as *
| rex field=host "(?<host_new>[^\.]+?)(?:\.[01]|\.02)?\."

and the second search is:
| rex field=Device_FQDN "(?<Device_FQDN>[^\.]+?)(?:\.[01]|\.02)?\."


So, what would the join look like?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...