I have a common field name for different sources. How do I view results from one source for this particular field name?

[rashid47010]

I have common signature fields for both devices (Palo Alto and McAfee IPS) in the results. I just want to see the results from McAfee IPS signature filed.

Please advise.

[rashid47010]

I got my required results.
at this stage two things in my mind.

1- for singature filed it shows me the signature values from both index/sourcetypes. I want to see the signature from only mcafee IPS

2- how can I show the result where as both devices have different field name for result

[aaraneta_splunk]

@rashid47010 - Just to clarify: Did cusello's suggestion of using index=your_index sourcetype=ips | ... help get the "required results" to answer your question?

[gcusello]

Use
index=your_index sourcetype=ips | ...
Bye.
Giuseppe

[somesoni2]

Both logs should have different sourcetype, so add mcafee IP specific sourcetype in your search (you can see the available sourcetypes of left field sidebar when you run the search).

[rashid47010]

thanks for quick reply, below is my query:

index=paloalto_pa OR index=mcafee_ips src="2xx.xx.x.x1" | transaction src | stats count as "TOTAL_ATTEMPTS",values(dest) as DESTINATION,values(dest_translated_ip) as NATED_IP,values(threat_name),values(signature) by src

for paloalto and mcafee IPS i have common signature field. For paloalto the thread_name(paloalto) gives me more value instead showing signature.
now for mcafee IPS there is only signature field which is OK for me. now the results showing only signature field from paloalto not from mcafee IPS