Splunk Search

How to compare IP's list from one Index with IP's in different index?

snallam123
Path Finder

Hello splunkers,

I have two different indexes with large number of IP's. Let's say 30k in one index A and >100k in other Inedx B. If IP's in Index A matches with IP's in Index B need to alert, IP's in both indexers are separate and matches once in a while.
I tried with appendcols, join but results are not accurate and taking long time for my search.

Is there any better way instead of these?

Thank you!

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

(index=your_index_a OR index=your_index_b)
IP=coalesce(<field name from your_index_a containing IP values>, <field name from your_index_b containing IP values)
| stats dc(index) as index_count by IP
| where index_count > 1

View solution in original post

woodcock
Esteemed Legend

Like this:

(index=your_index_a OR index=your_index_b)
IP=coalesce(<field name from your_index_a containing IP values>, <field name from your_index_b containing IP values)
| stats dc(index) as index_count by IP
| where index_count > 1

View solution in original post

snallam123
Path Finder

@woodcock this worked for me

(index=your_index_a OR index=your_index_b)
| eval IP=coalesce(, 1

Thanks a lot for your support

0 Karma

adonio
SplunkTrust
SplunkTrust

considering the name of the field in both indexes is IP a quick and dirty way can be something like this:

(index = your_index_a OR index=your_index_b) IP=* 
| stats dc(index) as unique_index by IP
| where unique_index > 1

hope it helps

0 Karma

snallam123
Path Finder

sorry, I tried it.
no luck

Thanks for the answer

0 Karma

adonio
SplunkTrust
SplunkTrust

what results are you getting?
mind sharing an event from each index?

0 Karma

snallam123
Path Finder

Added Eval IP= (values from index1 , values from index2) it worked.

Thanks.

0 Karma