Need help with combining two searches

[neeltiwari]

Hello Team,

How can I combine given below two searches and get the AWS instance name .

aws-description-resource( (aws_account_id="*") , (region="*") , "ec2_instances")
| search (private_ip_address="172.20.187.54")

index=c3d_security host=ip-172-23* rule=corp_deny_all_to_untrust NOT dest_port=4431 | table src_ip dest_ip transport dest_port application

Note: I am getting the output as sr_ip , dest_ip , transport dest_port and application so how can I combine these two searches and add the AWS instance name as table.

Regards,

Neelesh Tiwari

[isoutamo]

Hi

you are needing one or more common fields which has same values on both queries. After that you can combine those together e.g. with stats (or append or even join).

Here are some instructions how you can do it.

• https://conf.splunk.com/files/2020/slides/TRU1761C.pdf
• https://community.splunk.com/t5/Splunk-Search/What-is-the-relation-between-the-Splunk-inner-left-joi...

r. Ismo