Splunk Search

General question on concatenation or joining two indexes for data

brian1_tate
Path Finder

Hi all,

I read a few searches on this topic but I wasn't able to get this to work for me.

I have two datasources, one PaloAlto and the other Infoblox. The PaloAlto source has the events that I am attempting to match up by sourceaddress to mac (sometimes hostname) not present in Palo Alto.

So I tried using index=PaloAlto or index=Infoblox and then comparing sourceaddress, destinationaddress, destinationhostname but that didn't work to return mac address to them as mac address is only in InfoBlox and the destinationaddress will not match since the destination will be that of the Infoblox gateway. Seems the only correlating factor is the destination address but what I really want to return is the source addresses and mac addresses from Infobox that are accessing the same destinationip in PaloAlto.

Does this make sense?

So I tried something like

index= "PaloAlto" OR index = "Infoblox" | FIELDS resourcegroupname, sourceaddress, sourcemacaddress, destinationaddress, destinationhostname | destinationhostname = "yts.ag" OR destinationhostname = "zooqle.com"

This did not produce the desired result at all

So in this scenario - PaloAlto has the violation events, but InfoBlox has the mac address that the IP lease was assigned to and I need to return all events from the Infoblox datasource that have those destinations but maybe use eval (I think) to compare to the other index?

Thoughts here on syntax?

Tags (1)
0 Karma

cmerriman
Super Champion

can you give an example of data from each PaloAlto and InfoBlox with sensitive information scrubbed? I'm interested to know exactly what fields are in each index, so that I can better assist you. It sounds like you are trying to return the sourceaddress and sourcemacaddress, but if you could give an example of the desired output as well as sample data, it would be much more helpful.

0 Karma

mayurr98
Super Champion

See the syntax and requirement for join command here.
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Join
You need to have field with same name in both the searches

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...