Getting Data In

What is the best way display events from 2 indexes in chronological order, filtering by IP?

jbrenner
Path Finder

I have two indexes and I want to display events from both indexes in chronological order, filtering by a specific IP. What is the simplest way to accomplish this?

Thanks,
Jonathan

0 Karma
1 Solution

sdaniels
Splunk Employee
Splunk Employee

Are you just looking to see all of the raw events for those 2 indexes for a specific IP?

If so then something simple like this should give you what you need:

index=index1 OR index=index2 IP="10.10.210.1"

View solution in original post

sdaniels
Splunk Employee
Splunk Employee

Are you just looking to see all of the raw events for those 2 indexes for a specific IP?

If so then something simple like this should give you what you need:

index=index1 OR index=index2 IP="10.10.210.1"

jbrenner
Path Finder

That's exactly what I was looking for. I didn't realize it was that simple. Thanks!

0 Karma

skoelpin
SplunkTrust
SplunkTrust

You can do a sub-search across both indexes

index=index1 IP="123.34..56.192" Field="*" [search index=index2 IP="123.34..56.192" Field="*"] | stats count by IP

0 Karma

jbrenner
Path Finder

Thanks for the response. I tried your query, but I got no events back even though both of the following queries returns events:

index=index1 IP="XXX"
index=index2 IP="XXX"

Any ideas on why this might not be working?

Thanks,
Jonathan

0 Karma

skoelpin
SplunkTrust
SplunkTrust

index1, index2,Field, IP are just place holder names I put in there. You should use your index names and fields. Give me a sample of your data and I'll help build the query. You will need both index names and a common IP field which is present in both indexes

0 Karma

jbrenner
Path Finder

I understand. I just didn't want to reveal proprietary information, like our customers' IP addresses. 🙂
When I use the actual IP address, and the real index names, I get no records returned.

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...