Splunk Search

Compare Fields from Different Indexes and display only the duplicates.

ocgovsplunk
Engager

Hi,

I have two searches index= windows EventCode=1234 Logon_Type=8 | table host | dedup host
and index=iis host=*|table host|dedup host

How to combine both these queries to display only the hosts which have that particular EventCode and Type and also in the IIS index.

Thanks in advance.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Try something like this

(index=windows EventCode=1234 Logon_Type=8) OR (index=iis host=*)
| stats values(index) AS index by host 
0 Karma

ocgovsplunk
Engager

Thanks,

The above query is displaying the hosts which is either in index=windows or index=iis. I am looking for a list of only the hosts which are present in both the indexes.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...