Getting Data In

After matching 2 different data sources based on srcip, why is the output none?



I try to match two events in one search. one event must match virus and the other android. because the clearpass name for srcip is Ip_address i use the "|rename".

The problem is, the output is none. If I try OR instead of AND, it shows only clearpass output and if I delete the "|rename" it shows only syslog info.

(index="main" sourcetype="syslog") OR (index="main" sourcetype="aruba:cppm:syslog") |rename ip_address as srcip |transaction srcip keepevicted=true maxspan=-1 |search subtype="virus" AND device_family="android"
0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...