Hello Splunker>
I would like to convert my old correlation search which used the join function below:-
index=main sourcetype="firewall"
| join dstip [search index=main sourcetype="threat_lists"
| stats count by date, user, srcip, dstip, ETmsg
I want to use tstats & data model acceleration
Notes:-
data user srcip dstip >>>>firewall fields
ETmsg dstip >>>>>>>> threat_lists fields
dstip is common 🙂
@bravosec1 Based on the query you provided, you are joining data from two different sourcetypes when they share dstip
, then doing a stats count by.
index=main sourcetype="firewall"
| join dstip
[search index=main sourcetype="threat_lists" ]
| stats count by date, user, srcip, dstip, ETmsg
To convert this to a correlated search, we would need to know what data model these are going to and which fields in your original search map to which datamodel fields
Hi there @bravosec1
Start reading this first, http://docs.splunk.com/Documentation/CIM/4.10.0/User/Overview
But for this particular use case of yours I would choose summary indexing. Just my 2 cents
Hi @alemarzu
thank you ... but still I don't want to use the join command, so in my use case I want to correlate two data model seeking matching dstip field..
any help will be appreciated.