Splunk Search

How to add more fields to my table result in my search?

Path Finder

Hi I am trying to find Malware activity detected on vulnerable systems so I did the subsearch as follow:

source="antivirus log" [search source="Vulnerability scanner.csv" |dedup IP,Vulnerability|rename IP as dest |table dest]|table dest ResultStatus AttackName

It works correctly, but I was wondering how can I add more fields (not only the dest field that is common in both logs) from vulnerability scanner log to the final table, here as you see I can just table the fields that are in my Anti virus logs (dest ResultStatus AttackName).

Thanks,

Tags (2)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Give this a try

(source="antivirus log" [search source="Vulnerability scanner.csv" |stats count by IP|rename IP as dest |table dest] ) OR source="Vulnerability scanner.csv" | eval dest=coalesce(dest,IP) | stats dc(source) as sources values(Result_Status) as Result_Status values(Attack_Name) as Attack_Name values(Field1FromScannerlog) as Field1FromScannerlog values(Field1FromScannerlog) as Field1FromScannerlog... by dest | where sources=2 | fields - sources

View solution in original post

SplunkTrust
SplunkTrust

Give this a try

(source="antivirus log" [search source="Vulnerability scanner.csv" |stats count by IP|rename IP as dest |table dest] ) OR source="Vulnerability scanner.csv" | eval dest=coalesce(dest,IP) | stats dc(source) as sources values(Result_Status) as Result_Status values(Attack_Name) as Attack_Name values(Field1FromScannerlog) as Field1FromScannerlog values(Field1FromScannerlog) as Field1FromScannerlog... by dest | where sources=2 | fields - sources

View solution in original post