How to search on another index based on the first search condition?

[TrAnS]

Hi, i am trying to do a search which can shows which internal client accessed the web but i have a proxy to access the web on behalf.

So i have a internal client X.X.X.X 

my proxy internal IP is IP.IP.IP.IP

my proxy external IP is EP.EP.EP.EP

so i have a search 

index=* 8.8.8.8

The above search will show that my proxy(EP.EP.EP.EP) access this IP. So from here i would like to based on this result i need to search index=proxy where my IP is IP.IP.IP.IP to see which internal client access this 8.8.8.8

Can anyone guide me on how should i write my splunk search?

[DavidHourani]

Hi @TrAnS ,

There are multiple ways to do so, the first one would be using a subsearch : 

index=proxy [search index=other dest_ip=8.8.8.8 | table dest_ip]

This is not very efficient though, so it's best to run a combined search on both indices : 

(index=proxy OR index=other) dest_ip=8.8.8.8| stats values(index) dc(index) as indexCount by dest_ip | where indexCount>2

Let me know if the above helps.

Cheers,

David