Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Deployment Architecture
- :
- Re: Search for to different subtypes
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I want to search for any "virus" event in a two different subtype. Is it possible?
Thanks,
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can try like this
(index=A1 sourcetype=S1 type=traffic,subtype=forward) OR (index=A2 sourcetype=S3 type=utm,subtype=virus) | search <<your condition/filter/criteria to find virus>>
Where A1-S1 and A2-S2 are index-sourcetype combination for different subtype
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can try like this
(index=A1 sourcetype=S1 type=traffic,subtype=forward) OR (index=A2 sourcetype=S3 type=utm,subtype=virus) | search <<your condition/filter/criteria to find virus>>
Where A1-S1 and A2-S2 are index-sourcetype combination for different subtype
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What do you mean by subtype ? is this event type ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes. That's what I mean.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That depends completely on what eventtypes you have, what your definitions are for "virus events", and a number of other factors. Please provide more details with log samples and fields, and we'll stand a better chance of helping you.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I want to manage logging from my fortigate firewall. There are two subtypes where fortigate is detecting a virus type of event. First is coming from "type=traffic,subtype=forward" and the other one is from "type=utm,subtype=virus" . I want to search for any virus from those two different subtypes? Is it possible?
Thanks,
Index This | Why did the turkey cross the road?
Enter the Agentic Era with Splunk AI Assistant for SPL 1.4
Feel the Splunk Love: Real Stories from Real Customers
