Splunk Search

Combine of two different queries for single output (Aruba with Splunk)

New Member

Hi Team we have two queries as mentioned below:

eventtype=cppm-fail-authentication cphost=* -->This gives me the list of failed authentication of users.

eventtype=cppm CPPM_Endpoint_Profile cphost=* hostname="*" * | table hostname,device_category, device_family, device_name, mac_vendor, mac_address, fingerprint, static_ip -->This gives me the profiling details of the device like, mac, ip, os type etc.

My requirement is that I want to combine both the queries so that we can get the device fingerprint details for failed authentication.

Tags (1)
0 Karma


Try this:

(eventtype=cppm-fail-authentication OR  eventtype=CPPM_Endpoint_Profile)  cphost=*  | table  eventtype,hostname,device_category, device_family, device_name, mac_vendor, mac_address, fingerprint, static_ip
0 Karma
Get Updates on the Splunk Community!

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Want a chance to win $500 to the Splunk shop? Take our IT Incident Management Survey!

  Top Trends & Best Practices in Incident ManagementSplunk is partnering up with Constellation Research to ...