Splunk Search

How to search for specific IP addresses in a proxy index and compare them to another index?

ivar9692
Explorer

Hi, I'm searching for specific IP's in proxy index and trying to compare the output of that to other index (which gives the additional info about those IP's which match the condition i gave in proxy logs index) but i'm not getting any result.

I need to do above in only 1 search. I'm using subsearch command but unable to get any result. individually both are working fine if i run 1st search then pick those IP's and give it into 2nd index manually. Right now i'm using:

index=ipinfo ip_s="ip" [search index=proxylogs "conditions" |  fields ip]  stats values(ipinfo) values(fileds in index ipinfo).

i think subsearch can be used with same index only, that's why it is not working. Or the fields i'm comparing have different names. do i need to rename fields in subsearch before comparing to main search?

Please help

0 Karma

inventsekar
SplunkTrust
SplunkTrust

was it a typo or did you miss a "|" before the stats command?
your query - index=ipinfo ip_s="ip" [search index=proxylogs "conditions" | fields ip] stats values(ipinfo)

 index=ipinfo ip_s="ip" [search index=proxylogs "conditions" | fields ip] | stats values(ipinfo)...
thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !

somesoni2
Revered Legend

Also, make sure that field name that contains IP ifnormation is same in both proxylogs and ipinfo index. If not that add a rename command in subsearch to make both field name same.

index=ipinfo ip_s="ip" [search index=proxylogs "conditions" | stats count by ip | table ip | rename ip as ipFieldNameInipinfoIndex ] | stats values(ipinfo)...
0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...