Getting Data In

Fields in another sourcetype

rubeniturrieta
Communicator

Hi everyone:

I have two sourcetypes: Cisco WSA, and Cisco ASA. WSA has user data, but ASA don't.
I want to have the users for every source ip (src_ip) for asa. I have DHCP.
I have for example, this:


ASA top src_ip

timestamp ! src_ip ! count
a ! ip_a ! 2
b ! ip_b ! 5

c ! ip_c ! 7

but I need this:

ASA top src_ip

timestamp ! src_ip ! count ! user
a ! ip_a ! 2 ! u1
b ! ip_b ! 2 ! u5
d ! ip_b ! 2 ! u2
c ! ip_c ! 4 ! u1
e ! ip_c ! 3 ! u5


Do someone know how to do something like this?

0 Karma
1 Solution

stephane_cyrill
Builder

Hi,
I think that you can use the appendcols command to do that.
To have the resulting table you need you have to pipe the search that produce the first result without user and then you use appendcols [ ] .in the square brakets you put the search that will produce only the field user from WSA sourcetype.
At the end you pipe all and you can use table command to display what you wanted. just like this:

search from ASA sourcetype | appendcols [subsearch from WSA] |table timestamp scr_ip count user

View solution in original post

stephane_cyrill
Builder

Hi,
I think that you can use the appendcols command to do that.
To have the resulting table you need you have to pipe the search that produce the first result without user and then you use appendcols [ ] .in the square brakets you put the search that will produce only the field user from WSA sourcetype.
At the end you pipe all and you can use table command to display what you wanted. just like this:

search from ASA sourcetype | appendcols [subsearch from WSA] |table timestamp scr_ip count user

Get Updates on the Splunk Community!

This Week's Community Digest - Splunk Community Happenings [9.26.22]

Get the latest news and updates from the Splunk Community here! Upcoming User Group Events! 👏 Check ...

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...