Hi All,
i didn't get the result by using this below query search.
how to check and confirm the index and source type specifically to precise the query
index=*| search src=**.**.***.** OR **.**.***.** dest_ip=**.***.***.*** dest_port=443
How to confirm the source type and index
Hi Thanks for the reply..
yes I have some index and sourcetypes
but I don't know how to choose the index and sourcetypes for this ip address
Thanks,
Hi @Jana42855,
the first step is to know the data to search, otherwise it's very difficoult!
Anyway, you could start to run a search like the following:
index=<your_index> (src=* OR dest_ip=* OR dest_port=*)
in this way you have all the events containing these fields.
then you can analyze them and identify index and sourcetype to use.
Remember that you can see only the indexes where you were enabled, in other words, if you don't have grants to access an index you don't see it.
Ciao.
Giuseppe
yes I have some index and sourcetypes
but I don't know how to choose the index and sourcetypes for this ip address
Can you confirm this: So you want to know which index/indices, and which sourcetype(s) contain records of interest. Is this correct?
index=* src=**.**.***.** OR **.**.***.** dest_ip=**.***.***.*** dest_port=443
| stats count by index sourcetype
This should give you a list of index-sourcetype combinations that contain the specific IP and port. (Also, if you can use search command immediately following a search command, the two search commands should be combined into one. (The first command is an implied "search".)
Hi @Jana42855 ,
I suppose that you already have the log indexed and stored in an index with one sourcetype.
At first you should define the index where the logs are stored and the sourcetype to use.
Then, using this index and this sourcetype, you should check if the field names are correct (field names are case sensitive) and if the fields to use in the search ( src, dest_ip, dest_port) are present in all events.
then you don't need to use the search command, put all the parameters in the main search, you'll have a more performant search, then don't use index=*, because is slower than index=your_index.
index=<your_index> src=**.**.***.** OR **.**.***.** dest_ip=**.***.***.*** dest_port=443
Ciao.
Giuseppe