Splunk Enterprise Security

How to mix fields from two sourcetypes

pacmac
Explorer

Hello,

I have these two searches:

sourcetype=pan:threat src IN (10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12)
| where raw_category = "web-advertisements"
| stats count by src
| sort count DESC

and

sourcetype="WinEventLog:Security" 
| stats count by Account_Name 
| top limit=1 Account_Name 
| table Account_Name 

The src field from "pan:threat" sourcetype will be found as "Source Address" or "Source Network Address" on "WinEventLog:Security" sourcetype.

I want to retrieve the Account_Name field from "WinEventLog:Security" for each src on "pan:threat" and show them in a table with src and count from "pan:threat" and Account_Name from "WinEventLog:Security". is this possible?

Thanks in advance.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

That can be done without using join.

(sourcetype=pan:threat src IN (10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12) raw_category = "web-advertisements") OR
sourcetype="WinEventLog:Security" 
| eval src=coalesce(src, 'Source Address', 'Source Network Address')
| stats values(*) as * by src
| stats count values(src) as src by Account_Name
| top limit=1 Account_Name 
| table src Account_Name count
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

That can be done without using join.

(sourcetype=pan:threat src IN (10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12) raw_category = "web-advertisements") OR
sourcetype="WinEventLog:Security" 
| eval src=coalesce(src, 'Source Address', 'Source Network Address')
| stats values(*) as * by src
| stats count values(src) as src by Account_Name
| top limit=1 Account_Name 
| table src Account_Name count
---
If this reply helps you, Karma would be appreciated.

raduurjan
Explorer

Hello,

This can be possible using join command but you need to have 2 identical field names.
You can use eval or rename to make 2 identical fields and than use a left join on the common field.

You can find join documentation here:

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Join

0 Karma

pacmac
Explorer

Thanks for editing @evzhang

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...