Splunk Enterprise Security

comparing two fields from different indexes

deepak007
Explorer

I have 2 indexes which have common values in their fields
index1 has a field dest containing few values which are matching to index2 DESTIP
need to create a search query for getting the values only for the matching value of
index1 dest and index2 DESTIP

I tried
index=index1 OR index=index2 |eval destination=coalesce(dest, DESTIP)| table destination, app
and its not working

0 Karma
1 Solution

493669
Super Champion

try this:

index=index1 OR index=index2| eval destination=case(isnotnull(dest), dest, isnotnull(DESTIP), DESTIP, 1=1, "unknown")| stats values(*) AS * by destination

OR

index=index1 OR index=index2 |eval destination=coalesce(dest, DESTIP)| stats values(*) AS * by destination

View solution in original post

niketn
Legend

@deepak007, you should ideally create a Field Alias so that the field name becomes the same in both indexes and can be used for correlation.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

493669
Super Champion

try this:

index=index1 OR index=index2| eval destination=case(isnotnull(dest), dest, isnotnull(DESTIP), DESTIP, 1=1, "unknown")| stats values(*) AS * by destination

OR

index=index1 OR index=index2 |eval destination=coalesce(dest, DESTIP)| stats values(*) AS * by destination
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...