Splunk Search

How to join 2 event ID in same index (wineventlog)?

10061987
Engager

Hi all,

I searched my issue on community. There are lots of threads but i couldn't find my issue. As i know i can not see 2 event ID's fields (both of them) in same search because fields are different. I want to see 2 different event ID's fields in same search.

My issue is bit complicated. For this reason i will explain with basic fields and i will change later.

First search:
index=wineventlog EventID=1 process_name=chrome.exe
| stats count by Image process_name process_path CommandLine

Second search:

index=wineventlog EventID=3 DestinationHostname=google.com
| stats count by Image SourceIP DestinationIP DestinationHostname

 

I want join these 2 searches in same search and i want to see 2 different event ID' s fields in same search. I found join command but i couldn't figure out how to use that.

Any help would be appreciated!

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

More words please. You showed two summarizing searches which do not seem to share any fields so it's unclear how you would like to join them. Especially that you wrote about matching events.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...