Splunk Search

Is it possible to search 2 different IP fields' rare limits to graph them both and see if any IP addresses overlap?

BITSIntern
Path Finder

Hi

I was wondering if it was possible to search 2 different field's limits. I have tried using join, append, set diff and none have gotten me what I want. What I need is to be able to compare the rare limits of the field ip_source and the field ip_destination such that I can graph them both and see if any ip addresses overlap.

This is my most recent search:

set diff [search host="intern-Studio-1737" | rare limit=20 ip_destination] [search  host="intern-Studio-1737" | rare limit=20 ip_source ]

Please let me know if you can help!

Tags (5)
0 Karma
1 Solution

woodcock
Esteemed Legend

Try this:

[search host="intern-Studio-1737" | rare limit=20 ip_destination | eval joiner=ip_destination] | append [search host="intern-Studio-1737" | rare limit=20 ip_source | eval joiner=ip_source ] | stats values(*) AS * by joiner

This will give you the fields from the events in each source that share the same IP address and drop all the other events' fields.

View solution in original post

stephanefotso
Motivator

Hello! Did you use the join like this?

  ......   host="intern-Studio-1737" | rare limit=20 ip_destination|join  [search host="intern-Studio-1737" | rare limit=20 ip_source ]|table ip_destination ip_source
SGF
0 Karma

BITSIntern
Path Finder

Thanks for the help! This didn't really get me the result I wanted but it helped!

0 Karma

woodcock
Esteemed Legend

Try this:

[search host="intern-Studio-1737" | rare limit=20 ip_destination | eval joiner=ip_destination] | append [search host="intern-Studio-1737" | rare limit=20 ip_source | eval joiner=ip_source ] | stats values(*) AS * by joiner

This will give you the fields from the events in each source that share the same IP address and drop all the other events' fields.

BITSIntern
Path Finder

THANK YOU!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...