How would I combine data in Splunk so I can view them on one page?

[Chris231289]

Hi i am new, 

I have 2 excel documents, one containing firewall logs and the other containing Sys logs. how would i combine the data in splunk so i can view them on one page

I want to compare when the firewall  was used (and its destination IP) to when FTP was used (from syslogs).

Thank you

[yuanliu]

This question is very broad, but combining data is at the very foundation of Splunk.  So, without specifics, suppose you have a sourcetype firewall (with firewall logs), and another sourcetype syslog (containing syslogs); suppose source IP in firewall logs is named dst_ip, and FTP server's IP is ftp_ip.  You didn't specify what combined result you want, so I'll just use a dumb example.

sourcetype IN (firewall, syslog)
| eval ip_of_interest = coalesce(dst_ip, ftp_ip)
| bin span=5m _time
| stats values(sourcetype) as sources by ip_of_interest _time
| where mvcount(sources) > 1

This will give you time periods when dst_ip and ftp_ip appeared in the same 5-minute time window.

Hope this helps 

[richgalloway]

I'll add to what @yuanliu said by pointing out that Splunk cannot ingest Excel files because they are not text.  You would have to save them as CSV files to load them into Splunk.