I would like to convert my old correlation search which used the join function below:-
| join dstip [search index=main sourcetype="threat_lists"
| stats count by date, user, srcip, dstip, ETmsg
I want to use tstats & data model acceleration
data user srcip dstip >>>>firewall fields
ETmsg dstip >>>>>>>> threat_lists fields
dstip is common 🙂
@bravosec1 Based on the query you provided, you are joining data from two different sourcetypes when they share
dstip, then doing a stats count by.
index=main sourcetype="firewall" | join dstip [search index=main sourcetype="threat_lists" ] | stats count by date, user, srcip, dstip, ETmsg
To convert this to a correlated search, we would need to know what data model these are going to and which fields in your original search map to which datamodel fields
thank you ... but still I don't want to use the join command, so in my use case I want to correlate two data model seeking matching dstip field..
any help will be appreciated.