Getting Data In

After matching 2 different data sources based on srcip, why is the output none?



I try to match two events in one search. one event must match virus and the other android. because the clearpass name for srcip is Ip_address i use the "|rename".

The problem is, the output is none. If I try OR instead of AND, it shows only clearpass output and if I delete the "|rename" it shows only syslog info.

(index="main" sourcetype="syslog") OR (index="main" sourcetype="aruba:cppm:syslog") |rename ip_address as srcip |transaction srcip keepevicted=true maxspan=-1 |search subtype="virus" AND device_family="android"
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.