Hi,
I try to match two events in one search. one event must match virus and the other android. because the clearpass name for srcip is Ip_address i use the "|rename".
The problem is, the output is none. If I try OR instead of AND, it shows only clearpass output and if I delete the "|rename" it shows only syslog info.
(index="main" sourcetype="syslog") OR (index="main" sourcetype="aruba:cppm:syslog") |rename ip_address as srcip |transaction srcip keepevicted=true maxspan=-1 |search subtype="virus" AND device_family="android"
