How do I find all IPs that generated an HTTP 200 in one index & also generated an event (Snort alert) in another index?

[ErraticIncome93]

I want to take the values of src_ip from this search: index=http status=200

and see which of those source IPs also generated an event in index=snort

[woodcock]

Assuming that the host field contains the IP of the system that generated the Snort alert (adjust to proper field name if not), this should work:

index=snort [index=http status=200 | rename src_ip AS host | fields host]

[NOUMSSI · Accepted solution]

hi try this:

index=http status=200 src_ip=*|table src_ip|join[search index=snort| table * ]