Splunk Search

Create query to lookup multiple indexes

Yadukrishnan
Explorer

Hi,

Is it possible to make use of multiple indexes in one query. Below is the use case which I am trying to implement. 

If the connection from a IP address has a threat signature match in IPS, then look for the same address in WAF and if the WAF action is alerted, then trigger the alert. If the WAF action is blocked, then the alert can be suppressed. 

Is it possible to implement this use case. I am just trying to fine tune our detection capabilities as much as possible. 

Labels (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Yadukrishnan,

yes you can search something in many indexes, the only attention is that you have to know which are the key fields: e.g if you have a field called IP in both indexes and a lookup containing the threat signatures in a column called IP, you could run something like this:

(index=ips [ | inputlookup threat_signatres.csv | fields IP ]) OR index=waf
| stats dc(indexes) AS dc_indexes values(indexes) AS indexs BY IP
| where dc_indexes=2

in few words, you have to create in the main search both the search conditions united by the OR condition, then grouping results by the common field you have to check if the field in in both the indexes.

you could also use the second search as subsearch but this solution has the limit of 50,000 results for the subsearch:

index=ips [ | inputlookup threat_signatres.csv | fields IP ] [ search index=waf | fields IP ]
| ...

 for this reason I always prefer the first solution.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @Yadukrishnan,

yes you can search something in many indexes, the only attention is that you have to know which are the key fields: e.g if you have a field called IP in both indexes and a lookup containing the threat signatures in a column called IP, you could run something like this:

(index=ips [ | inputlookup threat_signatres.csv | fields IP ]) OR index=waf
| stats dc(indexes) AS dc_indexes values(indexes) AS indexs BY IP
| where dc_indexes=2

in few words, you have to create in the main search both the search conditions united by the OR condition, then grouping results by the common field you have to check if the field in in both the indexes.

you could also use the second search as subsearch but this solution has the limit of 50,000 results for the subsearch:

index=ips [ | inputlookup threat_signatres.csv | fields IP ] [ search index=waf | fields IP ]
| ...

 for this reason I always prefer the first solution.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

Industry Solutions for Supply Chain and OT, Amazon Use Cases, Plus More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...