Getting Data In

make a joint report from two different Hosts in two different sources


Hey Guys,

I have two different sourcetypes for my search, one of them is nmap.txt (which includes nmap trace s results from ports in our subnet among the whole 254 hosts, like Open/close Ports at different time sluts, OS version is running on target host and obviously on that IP Address) and the remedy.csv file (which includes data about IP addresses in subnet, details such the name of the user who has/had that IP address, DNS, is that IP free now or assigned, etc.)

data example in remedy.csv:

IP_Addr="" User="Sina" Status="assigned" Name=""


data example in nmap.txt:

host starttime="1402600202" endtime="1402601288" status state="up" reason="echo-reply" reason_ttl="63" address addr="" hostname name="" type="PTR" hostnames ports extraports state="filtered" count="985" extrareasons reason="no-responses" count="985" extraports port protocol="tcp" portid="20" state state="Open" service name="ftp-data" port protocol="tcp" portid="443" state state="Open" port protocol="tcp" portid="60443" state state="closed"


what I need is a table like below, using these fields together, from two hosts. such this:

IP----------------DNS-------------USER--------------Status(Free or not)--------------Ports(Open) -- -- Sina -- assigned -- 20,443 -- -- Mat -- assigned -- 80,443


(I know it doesn't look so good here, but supposed to be in table format)

p.s: just please notice that some fields with same value has different names in different sources and I just need the open ports (for example IP_Addr and DNS )

may anybody please help me with this? since I'm a beginner and not so professional with Splunk.

Thanks in advance


0 Karma


Assuming those two files are indexed in splunk and the fields are extracted:

You could try this:

sourcetype=remedy | fields [include   fields that you want] | join IP_Addr [search sourcetype=nmap | stats list(portid) as Ports by IP_Addr] | table IP_Addr DNS USER Status Ports
0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...