Splunk Search

Correlating Data from 2 Indexes

splunkcol
Builder

I have 2 indexes, one called linux and another called firewall, how can I correlate both indexes to determine if the src field (of the linux index) is equal to the UserIP field (of the firewall index)

 

Labels (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @splunkcol,

let me understand: you have two indexes and you want to list all the IPs in both the archives indicanding if they are present in both or only in one, is it correct?

if this is your need, you could run something like this:

index=linux OR index=firewall
| eval ip=coalesce(src,UserIP)
| stats dc(index) AS dc_index values(index) AS index BY ip
| eval status=if(dc_index=2,"Both indexes",if(index="linux","Linux Index","Firewall Index"))
| sort ip
| table ip status

Ciao.

Giuseppe

 

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @splunkcol,

let me understand: you have two indexes and you want to list all the IPs in both the archives indicanding if they are present in both or only in one, is it correct?

if this is your need, you could run something like this:

index=linux OR index=firewall
| eval ip=coalesce(src,UserIP)
| stats dc(index) AS dc_index values(index) AS index BY ip
| eval status=if(dc_index=2,"Both indexes",if(index="linux","Linux Index","Firewall Index"))
| sort ip
| table ip status

Ciao.

Giuseppe

 

gcusello
SplunkTrust
SplunkTrust

Hi @splunkcol,

good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...