Splunk Search

Compare Fields from Different Indexes and display only the duplicates.

ocgovsplunk
Engager

Hi,

I have two searches index= windows EventCode=1234 Logon_Type=8 | table host | dedup host
and index=iis host=*|table host|dedup host

How to combine both these queries to display only the hosts which have that particular EventCode and Type and also in the IIS index.

Thanks in advance.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Try something like this

(index=windows EventCode=1234 Logon_Type=8) OR (index=iis host=*)
| stats values(index) AS index by host 
0 Karma

ocgovsplunk
Engager

Thanks,

The above query is displaying the hosts which is either in index=windows or index=iis. I am looking for a list of only the hosts which are present in both the indexes.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...