Splunk Search

How to search field in two indexes?

shashilendraman
Explorer

how to search value of "Dst_IP" field from "ASA" index to "otx" index "indicator" field and display the scrip" field from "ASA" index.

Labels (1)

shashilendraman
Explorer

Hi Gcusello,

output is blank for  below query.

index=*asa* [search index=otx sourcetype="otx:indicator" type=IPv4 indicator=* |rename indicator as dst_ip|fields dst_ip]|dedup src_ip|table src_ip.

how ever i manually ping/trace 1 ip address which is in indicator field for testing purpose and i can see those IP in ASA  logs in splunk.  

Thanks

shashi

 

 

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @shashilendraman,

manually run the subsearch, them manually use the results in the main search and analyze them to understand  if results are compatible with the main search (e.g. format, or message, etc...) and if the search must have results.

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

hi @shashilendraman ,

let me understand:

you want to filter the "ASA" index events using the events from the "otx" index, using as correlation key the fields "Dst_IP" field from "ASA" and the "indicator" field from "otx" index; then you want to display   the "scrip" field from "ASA" index, is it correct?

if this is your requirement, please try this:

index=ASA [ search index=otx indicator=* | rename indicator AS Dst_IP | fields Dst_IP ] 
| dedup scrip
| sort scrip
| table scrip

Ciao.

Giuseppe

0 Karma

shashilendraman
Explorer

yes , you correct , but i am not getting desire output.

i am attaching ASA index output , otx index output and Correlation SPL which i prepared as you suggested.ASA index.pngotx index.pngCorrelation SPLCorrelation SPL

 

 

0 Karma

shashilendraman
Explorer

otx index.pngASAASA

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...