Getting Data In

What is the best way display events from 2 indexes in chronological order, filtering by IP?

jbrenner
Path Finder

I have two indexes and I want to display events from both indexes in chronological order, filtering by a specific IP. What is the simplest way to accomplish this?

Thanks,
Jonathan

0 Karma
1 Solution

sdaniels
Splunk Employee
Splunk Employee

Are you just looking to see all of the raw events for those 2 indexes for a specific IP?

If so then something simple like this should give you what you need:

index=index1 OR index=index2 IP="10.10.210.1"

View solution in original post

sdaniels
Splunk Employee
Splunk Employee

Are you just looking to see all of the raw events for those 2 indexes for a specific IP?

If so then something simple like this should give you what you need:

index=index1 OR index=index2 IP="10.10.210.1"

jbrenner
Path Finder

That's exactly what I was looking for. I didn't realize it was that simple. Thanks!

0 Karma

skoelpin
SplunkTrust
SplunkTrust

You can do a sub-search across both indexes

index=index1 IP="123.34..56.192" Field="*" [search index=index2 IP="123.34..56.192" Field="*"] | stats count by IP

0 Karma

jbrenner
Path Finder

Thanks for the response. I tried your query, but I got no events back even though both of the following queries returns events:

index=index1 IP="XXX"
index=index2 IP="XXX"

Any ideas on why this might not be working?

Thanks,
Jonathan

0 Karma

skoelpin
SplunkTrust
SplunkTrust

index1, index2,Field, IP are just place holder names I put in there. You should use your index names and fields. Give me a sample of your data and I'll help build the query. You will need both index names and a common IP field which is present in both indexes

0 Karma

jbrenner
Path Finder

I understand. I just didn't want to reveal proprietary information, like our customers' IP addresses. 🙂
When I use the actual IP address, and the real index names, I get no records returned.

0 Karma
Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...