General question on concatenation or joining two indexes for data

[brian1_tate]

Hi all,

I read a few searches on this topic but I wasn't able to get this to work for me.

I have two datasources, one PaloAlto and the other Infoblox. The PaloAlto source has the events that I am attempting to match up by sourceaddress to mac (sometimes hostname) not present in Palo Alto.

So I tried using index=PaloAlto or index=Infoblox and then comparing sourceaddress, destinationaddress, destinationhostname but that didn't work to return mac address to them as mac address is only in InfoBlox and the destinationaddress will not match since the destination will be that of the Infoblox gateway. Seems the only correlating factor is the destination address but what I really want to return is the source addresses and mac addresses from Infobox that are accessing the same destinationip in PaloAlto.

Does this make sense?

So I tried something like

index= "PaloAlto" OR index = "Infoblox" | FIELDS resourcegroupname, sourceaddress, sourcemacaddress, destinationaddress, destinationhostname | destinationhostname = "yts.ag" OR destinationhostname = "zooqle.com"

This did not produce the desired result at all

So in this scenario - PaloAlto has the violation events, but InfoBlox has the mac address that the IP lease was assigned to and I need to return all events from the Infoblox datasource that have those destinations but maybe use eval (I think) to compare to the other index?

Thoughts here on syntax?

[cmerriman]

can you give an example of data from each PaloAlto and InfoBlox with sensitive information scrubbed? I'm interested to know exactly what fields are in each index, so that I can better assist you. It sounds like you are trying to return the sourceaddress and sourcemacaddress, but if you could give an example of the desired output as well as sample data, it would be much more helpful.

[mayurr98]

See the syntax and requirement for join command here.
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Join
You need to have field with same name in both the searches