Hello,
Cloud you give me some tips.
Search Query S1
index=S1
| bla bla bla
| stats value(dstIP) value(dstPort) value(srcIP) value(srcUser) by URL
In S1's results, I want to add "sum(Byte)", Byte is in S2.
Also S2's log has dstIP, dstPort and Byte.
From comparing S1_dstIP with S2_dstIP, I want to add "sum(Byte)" on the search result.
S1's log ={dstIP, dstPort, srcIP,srcPort, srcUser, URL}
S2's log ={dstIP, dstPort, srcIP,srcPort, srcUser, Bytes}
Result = dstIP, dstPort, srcIP,srcPort, srcUser, sum(Bytes) by URL
So then, I think it needs to be joined by comparing dstIP, dstPort
index=S1 OR index=S2
| eval key=dstIP."_".dstPort."_".srcIP."_".srcPort."_".srcUser
| stats values(URL) as URL sum(Byte) as Bytes by key
| rex field=key "(?<dstIP>.*?)_(?<dstPort>.*?)_(?<srcIP>.*?)_(?<srcPort>.*?)_(?<srcUser>.*)"
| table URL Bytes dstIP dstPort srcIP srcUser
| where isnotnull(URL)
see reference: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Stats