Splunk Search
Highlighted

Is it possible to search 2 different IP fields' rare limits to graph them both and see if any IP addresses overlap?

Path Finder

Hi

I was wondering if it was possible to search 2 different field's limits. I have tried using join, append, set diff and none have gotten me what I want. What I need is to be able to compare the rare limits of the field ip_source and the field ip_destination such that I can graph them both and see if any ip addresses overlap.

This is my most recent search:

set diff [search host="intern-Studio-1737" | rare limit=20 ip_destination] [search  host="intern-Studio-1737" | rare limit=20 ip_source ]

Please let me know if you can help!

Tags (5)
0 Karma
Highlighted

Re: Is it possible to search 2 different IP fields' rare limits to graph them both and see if any IP addresses overlap?

Esteemed Legend

Try this:

[search host="intern-Studio-1737" | rare limit=20 ip_destination | eval joiner=ip_destination] | append [search host="intern-Studio-1737" | rare limit=20 ip_source | eval joiner=ip_source ] | stats values(*) AS * by joiner

This will give you the fields from the events in each source that share the same IP address and drop all the other events' fields.

View solution in original post

Highlighted

Re: Is it possible to search 2 different IP fields' rare limits to graph them both and see if any IP addresses overlap?

Path Finder

THANK YOU!

0 Karma
Highlighted

Re: Is it possible to search 2 different IP fields' rare limits to graph them both and see if any IP addresses overlap?

Motivator

Hello! Did you use the join like this?

  ......   host="intern-Studio-1737" | rare limit=20 ip_destination|join  [search host="intern-Studio-1737" | rare limit=20 ip_source ]|table ip_destination ip_source
0 Karma
Highlighted

Re: Is it possible to search 2 different IP fields' rare limits to graph them both and see if any IP addresses overlap?

Path Finder

Thanks for the help! This didn't really get me the result I wanted but it helped!

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.