Can you help me make a search that returns stats from two indexes when they match?

[christianubeda]

Hi team!

I'm new here, very first time with Splunk.

I need stats from two different indexes but only if they match.

If IP from indexA = src_ip from IndexB then i want stats from IndexB. Again, but only if they match.

I have this but it's not working. I need it to find the match but not to show me the correct stats.

Generated_time and dest_zone is crazy. It's supposed to show me 55 events and it shows me 2000, because 1 real event produces 50 fake event, and I don't know why that is.

This is my search right now.

(index=csvindex Ip=*) OR (index=cesa_paloalto src_ip=*) | eval match_ip=coalesce(Ip,src_ip) | stats values(*) AS * by match_ip | search src_ip=* Ip=* | stats count, values(src_zone) as Source_zone,values(dest_zone) as Destination_zone, values(threat_name) as "Threat name", values(vendor_action) as Action, values(severity) as Severity by user,src_ip, generated_time, dest_ip |table generated_time,"Threat name", Action,Severity src_ip, dest_ip,user, Source_zone, Destination_zone | rename src_ip as Source_IP, dest_ip as Destination_IP, user as User, generated_time as Date

Please help!

[kamlesh_vaghela]

@christianubeda

Can you please try below search?

index=cesa_paloalto 
    [ index=csvindex Ip=*  | dedup Ip | rename Ip as src_ip | table src_ip] 
| dedup src_ip 
| stats count, values(src_zone) as Source_zone,values(dest_zone) as Destination_zone, values(threat_name) as "Threat name", values(vendor_action) as Action, values(severity) as Severity by user,src_ip, generated_time, dest_ip 
| table generated_time,"Threat name", Action,Severity src_ip, dest_ip,user, Source_zone, Destination_zone 
| rename src_ip as Source_IP, dest_ip as Destination_IP, user as User, generated_time as Date