Is it possible to search 2 different IP fields' rare limits to graph them both and see if any IP addresses overlap?

[BITSIntern]

Hi

I was wondering if it was possible to search 2 different field's limits. I have tried using join, append, set diff and none have gotten me what I want. What I need is to be able to compare the rare limits of the field ip_source and the field ip_destination such that I can graph them both and see if any ip addresses overlap.

This is my most recent search:

set diff [search host="intern-Studio-1737" | rare limit=20 ip_destination] [search  host="intern-Studio-1737" | rare limit=20 ip_source ]

Please let me know if you can help!

[stephanefotso]

Hello! Did you use the join like this?

  ......   host="intern-Studio-1737" | rare limit=20 ip_destination|join  [search host="intern-Studio-1737" | rare limit=20 ip_source ]|table ip_destination ip_source

[BITSIntern]

Thanks for the help! This didn't really get me the result I wanted but it helped!

[woodcock · Accepted solution]

Try this:

[search host="intern-Studio-1737" | rare limit=20 ip_destination | eval joiner=ip_destination] | append [search host="intern-Studio-1737" | rare limit=20 ip_source | eval joiner=ip_source ] | stats values(*) AS * by joiner

This will give you the fields from the events in each source that share the same IP address and drop all the other events' fields.

[BITSIntern]

THANK YOU!