Show only matching IP's from two different fields

[sbattista09]

base search would be: index=index1 host=scan1 OR host=scan2

In the scans there are fields that are named differently but have Ip address in them, I would like Splunk to take the two fields and show me only the IP's that appear in both of them and get a total count. The names of the fields are IPAddressText and IPHost. I hope there is a simple eval statement someone could help me with.

thanks!

[sbattista09 · Accepted solution]

not sure if the will make sense but, i built it out a little differently and it works, i named the fileds in the CSV's the same that i need to compare counts-

[|inputlookup ipsav.csv] index=summaryindex host=host1 | timechart count | Rename count As "total count of host1" | appendcols[search [|inputlookup ipsav.csv] index=summaryindex host=host1 OR host=host2 |stats count by "FIELD NAMED THE SAME IN BOTH HOSTS"| Where count = 1 | stats count | Rename count as " show count if the count is only one"]

thanks for the help guys.

[sbattista09]

sorry, it did not work. its seems to be having trouble searching between the two fields. I say this because I ran just the index=index1 host=scan1 OR host=scan2 PAddressText=* IPHost=* part and nothing came up until i put a OR between the PAddressText=* IPHost=*.

[_d_]

See if this works for you:

index=index1 host=scan1 OR host=scan2 PAddressText=* IPHost=* | where IPAddressText=IPHost