Splunk Search

Join or Where statment


I have condition 1 [ index=sample offending_ip="*" ]
I have condition 2 [ index=main source="firewall" ]

I want to find anywere in condition 2 that match condition 1

Do I use Where or join or condition statments

I tried [ index=main source="firewall" | where index=sample offending_ip="*" ]

But this didn't work

Sorry More info on this:

I am trying to find raw data from "Firewall" where IP from "Firewall" manches (Dedup) IP from "offending_ip"

Thnaks for the help so fare. Ill try your sugestions

Tags (3)
0 Karma


How do they match? Tell us more specifics. For instance is there an ip field in firewall events whose values match up with the values of offending_ip in the sample events?

Also what are you trying to get for each of those IP's? Do you need the raw text or do you just want to get usernames or session ids or total bytes etc...?

Assuming there are two different IP fields involved, and you want to join on the IP values, and assuming that you want to get, say, the username, the simplest way is with stats.

(index=sample offending_ip=*) OR (index=main source="firewall") | eval status=if(isnull(offending_ip),firewall_ip_field,offending_ip) | stats last(user) by offending_ip

The eval clause there takes some getting used to but it is normalizing the field names for you, so that stats can zip it up using a consistent field name.

Almost everyone gravitates toward join at first, but it's only rarely the best tool for the job. In short join is a powerful but obscure and less performant tool for the corner cases that stats and transaction cannot handle.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!