Splunk Enterprise Security

Can you help me make a search that returns stats from two indexes when they match?

christianubeda
Path Finder

Hi team!

I'm new here, very first time with Splunk.

I need stats from two different indexes but only if they match.

If IP from indexA = src_ip from IndexB then i want stats from IndexB. Again, but only if they match.

I have this but it's not working. I need it to find the match but not to show me the correct stats.

Generated_time and dest_zone is crazy. It's supposed to show me 55 events and it shows me 2000, because 1 real event produces 50 fake event, and I don't know why that is.

This is my search right now.

(index=csvindex Ip=*) OR (index=cesa_paloalto src_ip=*) | eval match_ip=coalesce(Ip,src_ip) | stats values(*) AS * by match_ip | search src_ip=* Ip=* | stats count, values(src_zone) as Source_zone,values(dest_zone) as Destination_zone, values(threat_name) as "Threat name", values(vendor_action) as Action, values(severity) as Severity by user,src_ip, generated_time, dest_ip |table generated_time,"Threat name", Action,Severity src_ip, dest_ip,user, Source_zone, Destination_zone | rename src_ip as Source_IP, dest_ip as Destination_IP, user as User, generated_time as Date

Please help!

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@christianubeda

Can you please try below search?

index=cesa_paloalto 
    [ index=csvindex Ip=*  | dedup Ip | rename Ip as src_ip | table src_ip] 
| dedup src_ip 
| stats count, values(src_zone) as Source_zone,values(dest_zone) as Destination_zone, values(threat_name) as "Threat name", values(vendor_action) as Action, values(severity) as Severity by user,src_ip, generated_time, dest_ip 
| table generated_time,"Threat name", Action,Severity src_ip, dest_ip,user, Source_zone, Destination_zone 
| rename src_ip as Source_IP, dest_ip as Destination_IP, user as User, generated_time as Date
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...