Splunk Search

Need help with combining two searches

neeltiwari
Observer

Hello Team,

How can I combine given below two searches and get the AWS instance name .

aws-description-resource( (aws_account_id="*") , (region="*") , "ec2_instances")
| search (private_ip_address="172.20.187.54")

index=c3d_security host=ip-172-23* rule=corp_deny_all_to_untrust NOT dest_port=4431 | table src_ip dest_ip transport dest_port application

Note: I am getting the output as sr_ip , dest_ip , transport dest_port and application so how can I combine these two searches and add the AWS instance name as table.

 

Regards,

Neelesh Tiwari

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

you are needing one or more common fields which has same values on both queries. After that you can combine those together e.g. with stats (or append or even join).

Here are some instructions how you can do it.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...