Splunk Search

Search query with the field of a search like the one on another search

Path Finder

Hi all, i need to take the events from this search

sourcetype="wmi:wineventlog:security"

that have the field Source_Network_Address into the field DestinationIP of the search eventtype="searchIPS2" Direction="Inbound" Severity="Medium"

how can i do this? thanks to all who can help me

Tags (1)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

use subsearch:

eventtype=searchIPS2 Direction=Inbound Severity=Medium [ search sourcetype=wmi:wineventlog:security Source_Network_Address=* | fields Source_Network_Address | rename Source_Network_Address as DestinationIP ]

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

use subsearch:

eventtype=searchIPS2 Direction=Inbound Severity=Medium [ search sourcetype=wmi:wineventlog:security Source_Network_Address=* | fields Source_Network_Address | rename Source_Network_Address as DestinationIP ]

View solution in original post

0 Karma