Splunk Search

How do I search from 2 different indexes?

ajayrejin
Explorer

Hi,

How do I search in two indexes? I am looking for the IP address in both the indexes at that same point of time and correlate them.

One index is firewall and other index is Microsoft ATA.

vinod94
Contributor

Hi @ajayrejin ,

You can join command if if you have common field in both the indexes.

you can follow this doc for better reference.

https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/Join

or you can use transaction command

https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/Transaction

this might help you!

ajayrejin
Explorer

Hi,

There is no common field in both the indexes.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Like this

(index=A OR index=B)

ajayrejin
Explorer

Hi,
Okay.. That query would check either in A or B right.

What i am looking for here is, the IP is in both indexes and that IP is present in both indexes at the same time. I need to correlate them..
Ex: IP in index 1 is seen @ 12 PM, then same IP is also seen @ 12PM in index 2. How do i check this? If the IPs have seen @ same time.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Yes correct, this will search both indexes. If you want to coorelate between both indexes, you can use the search below to get you started.

You will need to replace your index name and srcip with the field-name of your IP value.

(index=A OR index=B)
| stats count earliest(_time) as _time by srcip
| where count >=2 
0 Karma

ajayrejin
Explorer

Thank you for the query. I tried that query, it gives me all the IPs from both the indexes. I wanted the common IP between the indexes

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...