Splunk Search

Merging events from two indexes

corti77
Contributor

I would like to create a dashboard to query the logs of our two firewall devices (paloalto and sns). Both has their own index created. 

Firstly I tried to simply query both indexes

 

 

index=pan_logs OR index=sns
| table _time, action, src_ip, dest_ip, app, user, src_port, dest_port, bytes

 

 

with the issue that in the stormshield index some fields are named slightly different. I then tried to rename the values in order to merge all events from both indexes... but I didnt succeed.

 

 

index=pan_logs
[ search
index=sns
| rename src as src_ip, dst as dest_ip
| eval bytes=bytes_in+bytes_out ]
| table _time, action, src_ip, dest_ip, app, user, src_port, dest_port, bytes

 

 

could someone point me to the right direction?

thanks a lot.

 

 

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @corti77,

your first approach is better: you have to use eval and rename to merge data, something like this:

index=pan_logs OR index=sns
| eval src_ip=if(index="sns",src,src_ip), dest_ip=if(index="sns",dst,dest_ip),  bytes=bytes_in+bytes_out 
| table _time action src_ip dest_ip app user src_port dest_port bytes

Ciao.

Giuseppe

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The second search was very close.  Using a subsearch creates a very different type of query, however.  Just add the rename command - there' s no need to associated it with a specific index because it will only apply to events with the stated fields.

index=pan_logs OR index=sns
| rename src as src_ip, dst as dest_ip
| eval bytes=bytes_in+bytes_out
| table _time, action, src_ip, dest_ip, app, user, src_port, dest_port, bytes
---
If this reply helps you, Karma would be appreciated.
0 Karma

corti77
Contributor

the field bytes already existed in paloalto logs, so with your query it might get overwrote .

below my draft query so far, using few variables

 

 

index=pan_logs OR index=sns 
| eval src_ip=if(index="sns",src,src_ip), dest_ip=if(index="sns",dst,dest_ip), bytes_new=if(index="sns",bytes_in+bytes_out, bytes)
| search src_ip="$source_ip$" AND dest_ip="$destination_ip$" AND action="$fw_action$"
| table _time, index, host, action, src_ip, dest_ip, app, user, src_port, dest_port, bytes_new, vendor_action

 

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @corti77,

your first approach is better: you have to use eval and rename to merge data, something like this:

index=pan_logs OR index=sns
| eval src_ip=if(index="sns",src,src_ip), dest_ip=if(index="sns",dst,dest_ip),  bytes=bytes_in+bytes_out 
| table _time action src_ip dest_ip app user src_port dest_port bytes

Ciao.

Giuseppe

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...