Combine multiple search fields

[jbanAtSplunk]

Hi, 

We have a scenario where we have three different events that should combine together based on Event ID.  

Example 

Event 1 Fields: 

• Hostname 
• Unique_ID 
• Has_Vulnerabilities 

 Event 2 Fields: 

• Scan_Date 
• Hostname_Unique_ID 
• Vulnerability_Id 

 Event 3 Fields: 

• Vulnerability_id 
• Description 
• Start_Date 
• … 

What we are trying to do is, when I click on “Event 1 Unique_ID” to get all Vulnerabilities for Selected Host for “Event 2” enriched with selected data from “Event 3”. 

All three events are in the same index but different sourcetype.  

What is the best approach here? Subsearch seems slow If I go “Event 2” first and then filter to “Event 1”. I want another way around.  

[isoutamo]

Can you clarify if you want an dashboard (as you are talking about clicks) and drill down to those events by individual hosts or do you want one query which contains all that info?

I suppose that Hostname == Hostname_Unique_ID or is there some other field on event 1 to match those?

r. Ismo

[jbanAtSplunk]

Eventually I will create dashboard. For now, search is enough just to get me going 🙂

we can use hostname=hostname_unique_id