Splunk Search

Combine of two different queries for single output (Aruba with Splunk)

New Member

Hi Team we have two queries as mentioned below:

eventtype=cppm-fail-authentication cphost=* -->This gives me the list of failed authentication of users.

eventtype=cppm CPPM_Endpoint_Profile cphost=* hostname="*" * | table hostname,device_category, device_family, device_name, mac_vendor, mac_address, fingerprint, static_ip -->This gives me the profiling details of the device like, mac, ip, os type etc.

My requirement is that I want to combine both the queries so that we can get the device fingerprint details for failed authentication.

Tags (1)
0 Karma


Try this:

(eventtype=cppm-fail-authentication OR  eventtype=CPPM_Endpoint_Profile)  cphost=*  | table  eventtype,hostname,device_category, device_family, device_name, mac_vendor, mac_address, fingerprint, static_ip
0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...