Splunk Search

Create query to lookup multiple indexes

Yadukrishnan
Explorer

Hi,

Is it possible to make use of multiple indexes in one query. Below is the use case which I am trying to implement. 

If the connection from a IP address has a threat signature match in IPS, then look for the same address in WAF and if the WAF action is alerted, then trigger the alert. If the WAF action is blocked, then the alert can be suppressed. 

Is it possible to implement this use case. I am just trying to fine tune our detection capabilities as much as possible. 

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Yadukrishnan,

yes you can search something in many indexes, the only attention is that you have to know which are the key fields: e.g if you have a field called IP in both indexes and a lookup containing the threat signatures in a column called IP, you could run something like this:

(index=ips [ | inputlookup threat_signatres.csv | fields IP ]) OR index=waf
| stats dc(indexes) AS dc_indexes values(indexes) AS indexs BY IP
| where dc_indexes=2

in few words, you have to create in the main search both the search conditions united by the OR condition, then grouping results by the common field you have to check if the field in in both the indexes.

you could also use the second search as subsearch but this solution has the limit of 50,000 results for the subsearch:

index=ips [ | inputlookup threat_signatres.csv | fields IP ] [ search index=waf | fields IP ]
| ...

 for this reason I always prefer the first solution.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @Yadukrishnan,

yes you can search something in many indexes, the only attention is that you have to know which are the key fields: e.g if you have a field called IP in both indexes and a lookup containing the threat signatures in a column called IP, you could run something like this:

(index=ips [ | inputlookup threat_signatres.csv | fields IP ]) OR index=waf
| stats dc(indexes) AS dc_indexes values(indexes) AS indexs BY IP
| where dc_indexes=2

in few words, you have to create in the main search both the search conditions united by the OR condition, then grouping results by the common field you have to check if the field in in both the indexes.

you could also use the second search as subsearch but this solution has the limit of 50,000 results for the subsearch:

index=ips [ | inputlookup threat_signatres.csv | fields IP ] [ search index=waf | fields IP ]
| ...

 for this reason I always prefer the first solution.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...