can i take $src_ip$ through1 index and use it other index in same query.

[rahul_acc_splun]

If i have 1 index for firewall i can get src_ip and src_host which is creating some issues then i need to check that src_ip in active directory index to get the account_name i mean user logged in. My question is how can i do this in 1 query
For eg--index=pan_logs i can get src_ip and machine name but i dont have account that being logged on. i need to go to index=AD to check

[rahul_acc_splun]

lets take an example I ran this query index=pan_logs src_ip=10.10.10.10 | stats count by dest_ip | where count >10000 now this dest_ip I need to check account name in AD logs can I do this type of thing | appendcols [search index=AD dest_ip=$dest_ip$ | table account_name | fields account_name ] | table account_name

[somesoni2]

You can do something like this (assuming both indexes have field src_ip with matching values

index=AD   [search index=pan_logs ...other search portion to get field src_ip | table src_ip ]
| table src_ip account_name 

[niketn]

@rahul_acc_splunk2, if your results from index="pan_logs" return a table with required src_ip, you can create a Table Drilldown to run another search with selected src_ip value in default token$row.src_ip$. Refer to Splunk Dashboard Examples app for various drilldown examples (https://splunkbase.splunk.com/app/1603/)

[sbbadri]

@rahul_acc_splunk2

try this,

1) index=pan_logs src_ip=xxxxx machine_name=xxxxx | appendcols [search index=AD src_ip=xxxxx machine_name=xxxx | table account_name | fields account_name ] | table src_ip machine_name account_name

check below link,

http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Appendcols

2) index=pan_logs OR index=AD | table src_ip machine_name account_name | stats values(account_name) as account_name by src_ip machine_name

i believe src_ip, machine_name and account_name fields are extracted.

Go through below link