Splunk Search

Using single query with two sourcetypes?

brc55
Explorer

I have 2 sourcetypes, vpn & winevents, how do you write a single query to get winevents of the top 5 busiest machines of IP X (1 IP is used by many users). The vpn sourcetype contains both hostname & IP, while the winevents only contains the hostname.

I'm assuming I'd utilize the append command and a sub search

sourcetype=winevents | append [search sourcetype=vpn] | top limit=5 

Any help is appreciated, thanks

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

usually the most efficient way is use stats on this kind of cases. Based on what you are meaning with "most busiest" you should use something like this:

index IN (vpn, winevents) sourcetype IN (<your sourcetypes here, separated with ,>)
| stats count(ip) as nIPs values(*) as * by hostname
| sort 0 - nIPs
| head 5

r. Ismo 

0 Karma

SinghK
Builder

(sourcetype=winevents OR sourcetype=vpn)| top limit=5 

0 Karma

tscroggins
Influencer

@brc55 

You can return events from multiple source types in one search:

(sourcetype=winevents OR sourcetype=vpn)

or:

sourcetype IN (winevents vpn)

What do you mean by "busiest" users of an IP address? Are you trying to 1) correlate winevents to the vpn IP address by hostname and 2) get the top 5 hostnames by IP address? This isn't difficult, but we'll need to know more about the fields available in the winevents and vpn source types.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...