Splunk Search

ES Search Help - How do I multi index join when IP address field is named differently between the two indexes?

lou_sierra
New Member

I have looked at the join documentation, but I am getting a little lost in translation.
What I am trying to accomplish, is to pull data from Index1, then join on IP address to another index to pull different information and display all of it.

Example:

 

Index=firewall dest_port=21
| stats values(dest_ip) as dest_ip values(dest_port) as dest_port sum(bytes_in) as bytes_in sum(bytes_out) as bytes_out values(app) as app values(rule) as rule by user src _time

Index=edr RPort=21 RemoteIP=$dest_ip-from-first-search

 



The output should be a table with the following:
firewall._time, firewall.src, firewall.dest_ip, edr.username, edr.username, edr.processname

The issue I am running into is the IP address field is named differently between the 2 indices.  Ideally I would join on firewall.dest_ip TO edr.RemoteIP

Any help would be appreciated. 

Labels (1)
0 Karma

smurf
Communicator

Hi,

I usually just rename the join field at the end of the subsearch or create the join field in the original search with eval.

It could look something like this:

index=firewall
| fields firewall._time, firewall.src, firewall.dest_ip
| eval edr.RemoteIP = firewall.dest_ip
| join
[ index=edr
| fields edr.username, edr.username, edr.processname edr.RemoteIP ]

 

smurf

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...