I would like to convert my old correlation search which used the join function below:-
| join dstip [search index=main sourcetype="threat_lists"
| stats count by date, user, srcip, dstip, ETmsg
I want to use tstats & data model acceleration
data user srcip dstip >>>>firewall fields
ETmsg dstip >>>>>>>> threat_lists fields
dstip is common 🙂
@bravosec1 Based on the query you provided, you are joining data from two different sourcetypes when they share
dstip, then doing a stats count by.
index=main sourcetype="firewall" | join dstip [search index=main sourcetype="threat_lists" ] | stats count by date, user, srcip, dstip, ETmsg
To convert this to a correlated search, we would need to know what data model these are going to and which fields in your original search map to which datamodel fields
Hi there @bravosec1
Start reading this first, http://docs.splunk.com/Documentation/CIM/4.10.0/User/Overview
But for this particular use case of yours I would choose summary indexing. Just my 2 cents
thank you ... but still I don't want to use the join command, so in my use case I want to correlate two data model seeking matching dstip field..
any help will be appreciated.