Splunk Search

Using single query with two sourcetypes?

brc55
Explorer

I have 2 sourcetypes, vpn & winevents, how do you write a single query to get winevents of the top 5 busiest machines of IP X (1 IP is used by many users). The vpn sourcetype contains both hostname & IP, while the winevents only contains the hostname.

I'm assuming I'd utilize the append command and a sub search

sourcetype=winevents | append [search sourcetype=vpn] | top limit=5 

Any help is appreciated, thanks

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

usually the most efficient way is use stats on this kind of cases. Based on what you are meaning with "most busiest" you should use something like this:

index IN (vpn, winevents) sourcetype IN (<your sourcetypes here, separated with ,>)
| stats count(ip) as nIPs values(*) as * by hostname
| sort 0 - nIPs
| head 5

r. Ismo 

0 Karma

SinghK
Builder

(sourcetype=winevents OR sourcetype=vpn)| top limit=5 

0 Karma

tscroggins
Influencer

@brc55 

You can return events from multiple source types in one search:

(sourcetype=winevents OR sourcetype=vpn)

or:

sourcetype IN (winevents vpn)

What do you mean by "busiest" users of an IP address? Are you trying to 1) correlate winevents to the vpn IP address by hostname and 2) get the top 5 hostnames by IP address? This isn't difficult, but we'll need to know more about the fields available in the winevents and vpn source types.

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...