How to compare IP's list from one Index with IP's in different index?

[snallam123]

Hello splunkers,

I have two different indexes with large number of IP's. Let's say 30k in one index A and >100k in other Inedx B. If IP's in Index A matches with IP's in Index B need to alert, IP's in both indexers are separate and matches once in a while.
I tried with appendcols, join but results are not accurate and taking long time for my search.

Is there any better way instead of these?

Thank you!

[woodcock · Accepted solution]

Like this:

(index=your_index_a OR index=your_index_b)
IP=coalesce(<field name from your_index_a containing IP values>, <field name from your_index_b containing IP values)
| stats dc(index) as index_count by IP
| where index_count > 1

[snallam123]

@woodcock this worked for me

(index=your_index_a OR index=your_index_b)
| eval IP=coalesce(, 1

Thanks a lot for your support

[adonio]

considering the name of the field in both indexes is IP a quick and dirty way can be something like this:

(index = your_index_a OR index=your_index_b) IP=* 
| stats dc(index) as unique_index by IP
| where unique_index > 1

hope it helps

[snallam123]

sorry, I tried it.
no luck

Thanks for the answer

[adonio]

what results are you getting?
mind sharing an event from each index?

[snallam123]

Added Eval IP= (values from index1 , values from index2) it worked.

Thanks.