Splunk Search

Combine multiple search fields

jbanAtSplunk
Communicator

Hi, 

We have a scenario where we have three different events that should combine together based on Event ID.  

Example 

Event 1 Fields: 

  • Hostname 
  • Unique_ID 
  • Has_Vulnerabilities 

 Event 2 Fields: 

  • Scan_Date 
  • Hostname_Unique_ID 
  • Vulnerability_Id 

 Event 3 Fields: 

  • Vulnerability_id 
  • Description 
  • Start_Date 
  •  

What we are trying to do is, when I click on “Event 1 Unique_ID” to get all Vulnerabilities for Selected Host for “Event 2” enriched with selected data from “Event 3”. 

All three events are in the same index but different sourcetype.  

What is the best approach here? Subsearch seems slow If I go “Event 2” first and then filter to “Event 1”. I want another way around.  

Labels (2)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Can you clarify if you want an dashboard (as you are talking about clicks) and drill down to those events by individual hosts or do you want one query which contains all that info?

I suppose that Hostname == Hostname_Unique_ID or is there some other field on event 1 to match those?

r. Ismo

0 Karma

jbanAtSplunk
Communicator

Eventually I will create dashboard. For now, search is enough just to get me going :slightly_smiling_face:

we can use hostname=hostname_unique_id

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...