How to search field in two indexes?

[shashilendraman]

how to search value of "Dst_IP" field from "ASA" index to "otx" index "indicator" field and display the scrip" field from "ASA" index.

[shashilendraman]

Hi Gcusello,

output is blank for  below query.

index=*asa* [search index=otx sourcetype="otx:indicator" type=IPv4 indicator=* |rename indicator as dst_ip|fields dst_ip]|dedup src_ip|table src_ip.

how ever i manually ping/trace 1 ip address which is in indicator field for testing purpose and i can see those IP in ASA  logs in splunk.  

Thanks

shashi

[gcusello]

Hi @shashilendraman,

manually run the subsearch, them manually use the results in the main search and analyze them to understand  if results are compatible with the main search (e.g. format, or message, etc...) and if the search must have results.

Ciao.

Giuseppe

[gcusello]

hi @shashilendraman ,

let me understand:

you want to filter the "ASA" index events using the events from the "otx" index, using as correlation key the fields "Dst_IP" field from "ASA" and the "indicator" field from "otx" index; then you want to display   the "scrip" field from "ASA" index, is it correct?

if this is your requirement, please try this:

index=ASA [ search index=otx indicator=* | rename indicator AS Dst_IP | fields Dst_IP ] 
| dedup scrip
| sort scrip
| table scrip

Ciao.

Giuseppe

[shashilendraman]

yes , you correct , but i am not getting desire output.

i am attaching ASA index output , otx index output and Correlation SPL which i prepared as you suggested.Correlation SPL

[shashilendraman]

ASA