Hi,
I have 3 indexes. I need to extract hash_values from index 3 and do a search to see if similar files exists in index 1 & 2 as well.
Index1 &2 has same field names, whereas index 3 has 3 different fields with the values. Now I need to have all these values in a single field and then do a search to compare if similar files exists in other indexes
Details:
=====
Index=1, sourcetype=1, hash_file
Index=2, sourcetype=2, hash_file
Index=3, sourcetype=3, hash_md5, hash_sha1, hash_sha256
Could someone please help me with a SPL?
Hi @Woodpecker,
please try this:
(index=1 sourcetype=1 hash=*) OR (index=2 sourcetype=2 hash=*) OR (index=3 sourcetype=3 (hash_md5=* OR hash_sha1=* OR hash_sha256=*))
| eval hash=coalesce(hash, hash_md5, hash_sha1, hash_sha256), type=if(index=1,"1","2")
| stats dc(type) AS dc_type values(type) AS type BY hash
| where dc_type=2
| table hash
Ciao.
Giuseppe