Splunk Search

How can I do a search to see if values of one index exists in other 2 indexes?

Woodpecker
Path Finder

Hi,

I have 3 indexes. I need to extract hash_values from index 3 and do a search to see if similar files exists in index 1 & 2 as well.

Index1 &2 has same field names, whereas index 3 has 3 different fields with the values. Now I need to have all these values in a single field and then do a search to compare if similar files exists in other indexes 

Details:
=====
Index=1, sourcetype=1, hash_file
Index=2, sourcetype=2, hash_file
Index=3, sourcetype=3, hash_md5, hash_sha1, hash_sha256

Could someone please help me with a SPL?

Labels (1)
Tags (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Woodpecker,

please try this:

(index=1 sourcetype=1 hash=*) OR (index=2 sourcetype=2 hash=*) OR (index=3 sourcetype=3 (hash_md5=* OR hash_sha1=* OR hash_sha256=*))
| eval hash=coalesce(hash, hash_md5, hash_sha1, hash_sha256), type=if(index=1,"1","2")
| stats dc(type) AS dc_type values(type) AS type BY hash
| where dc_type=2
| table hash

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...