Splunk Search

Using single query with two sourcetypes?

brc55
Explorer

I have 2 sourcetypes, vpn & winevents, how do you write a single query to get winevents of the top 5 busiest machines of IP X (1 IP is used by many users). The vpn sourcetype contains both hostname & IP, while the winevents only contains the hostname.

I'm assuming I'd utilize the append command and a sub search

sourcetype=winevents | append [search sourcetype=vpn] | top limit=5 

Any help is appreciated, thanks

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

usually the most efficient way is use stats on this kind of cases. Based on what you are meaning with "most busiest" you should use something like this:

index IN (vpn, winevents) sourcetype IN (<your sourcetypes here, separated with ,>)
| stats count(ip) as nIPs values(*) as * by hostname
| sort 0 - nIPs
| head 5

r. Ismo 

0 Karma

SinghK
Builder

(sourcetype=winevents OR sourcetype=vpn)| top limit=5 

0 Karma

tscroggins
Influencer

@brc55 

You can return events from multiple source types in one search:

(sourcetype=winevents OR sourcetype=vpn)

or:

sourcetype IN (winevents vpn)

What do you mean by "busiest" users of an IP address? Are you trying to 1) correlate winevents to the vpn IP address by hostname and 2) get the top 5 hostnames by IP address? This isn't difficult, but we'll need to know more about the fields available in the winevents and vpn source types.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...