Splunk Search

How to compare IP's list from one Index with IP's in different index?

snallam123
Path Finder

Hello splunkers,

I have two different indexes with large number of IP's. Let's say 30k in one index A and >100k in other Inedx B. If IP's in Index A matches with IP's in Index B need to alert, IP's in both indexers are separate and matches once in a while.
I tried with appendcols, join but results are not accurate and taking long time for my search.

Is there any better way instead of these?

Thank you!

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

(index=your_index_a OR index=your_index_b)
IP=coalesce(<field name from your_index_a containing IP values>, <field name from your_index_b containing IP values)
| stats dc(index) as index_count by IP
| where index_count > 1

View solution in original post

woodcock
Esteemed Legend

Like this:

(index=your_index_a OR index=your_index_b)
IP=coalesce(<field name from your_index_a containing IP values>, <field name from your_index_b containing IP values)
| stats dc(index) as index_count by IP
| where index_count > 1

snallam123
Path Finder

@woodcock this worked for me

(index=your_index_a OR index=your_index_b)
| eval IP=coalesce(, 1

Thanks a lot for your support

0 Karma

adonio
Ultra Champion

considering the name of the field in both indexes is IP a quick and dirty way can be something like this:

(index = your_index_a OR index=your_index_b) IP=* 
| stats dc(index) as unique_index by IP
| where unique_index > 1

hope it helps

0 Karma

snallam123
Path Finder

sorry, I tried it.
no luck

Thanks for the answer

0 Karma

adonio
Ultra Champion

what results are you getting?
mind sharing an event from each index?

0 Karma

snallam123
Path Finder

Added Eval IP= (values from index1 , values from index2) it worked.

Thanks.

0 Karma
Get Updates on the Splunk Community!

Splunk is Nurturing Tomorrow’s Cybersecurity Leaders Today

Meet Carol Wright. She leads the Splunk Academic Alliance program at Splunk. The Splunk Academic Alliance ...

Part 2: A Guide to Maximizing Splunk IT Service Intelligence

Welcome to the second segment of our guide. In Part 1, we covered the essentials of getting started with ITSI ...

Part 1: A Guide to Maximizing Splunk IT Service Intelligence

As modern IT environments continue to grow in complexity and speed, the ability to efficiently manage and ...