Splunk Search

How to combine 2 field searches with multiple values?

praveenmathew27
Engager

I want to search the logs that have a combination of source and destination IP's.
For e.g, I want to search the logs where the source is any of (a,b,c,d..etc) and destination is any of (1,2,3,4...etc)

Now for fewer cases, my query would be something like this:-
index=x (source=a OR source=b OR source=c) AND (destination=1 OR destination=2 OR destination=3)

Is there any easier way do the above for larger cases, like if i have 10 source and 10 destination, and I want to check for each combination, wiithout importing a CSV or anything, just basic query?

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

You can use the IN operator like this:

index=x (source= IN("a", "b", "c") AND (destination IN("1", "2," 3")

You could also exploit 2 lookup file that have these lines:

source
a
b
c
d

Like this:

index=x AND [|inputlookup source.csv | table source] AND [|inputlookup destination.csv | table destination]

You could also use a macro.

View solution in original post

woodcock
Esteemed Legend

You can use the IN operator like this:

index=x (source= IN("a", "b", "c") AND (destination IN("1", "2," 3")

You could also exploit 2 lookup file that have these lines:

source
a
b
c
d

Like this:

index=x AND [|inputlookup source.csv | table source] AND [|inputlookup destination.csv | table destination]

You could also use a macro.

jodyfsu
Path Finder

Are either the source or destination of the same subnet? If they are you could do source="10.0.0.*". If not, then you can do the CIDR but that still limits you to a specific range you would just be able to have broader range.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...