Splunk Search
Highlighted

Why is the top command not working when searching in two indexes?

New Member

Hello all,

For some reason, the search below isn't working for me... I am trying to search for the Top 25 Business Units that have triggered a DLP incident and sort it by those incidents... Unsure if it's the lack of caffeine, but I was under the impression this would work...

(index=dlp OR index=msad) (sourcetype=intel:dlp OR sourcetype=ActiveDirectory)  IncidentType="*" department="*" 
| Top 25 department
| sort by IncidentType

Greatly appreciate your inputs.

0 Karma
Highlighted

Re: Why is the top command not working when searching in two indexes?

Legend

Try this

(index=dlp OR index=msad) (sourcetype=intel:dlp OR sourcetype=ActiveDirectory) IncidentType="" department="" | top 25 department by IncidentType | sort by IncidentType
Highlighted

Re: Why is the top command not working when searching in two indexes?

New Member

Thank you sundareshr - but still no data... I've been trying other constants but no results.

0 Karma
Highlighted

Re: Why is the top command not working when searching in two indexes?

Communicator

use double quote when for sourcetype=intel:dlp ---- sourcetype="intel:dlp"

0 Karma
Highlighted

Re: Why is the top command not working when searching in two indexes?

New Member

Thank you puneethgowda - but still no data... I've been trying other constants but no results.

0 Karma
Highlighted

Re: Why is the top command not working when searching in two indexes?

Communicator

index=dlp sourcetype=intel:dlp OR index=msad sourcetype=ActiveDirectory

Try this

0 Karma
Highlighted

Re: Why is the top command not working when searching in two indexes?

Communicator

index="dlp" sourcetype="intel:dlp" OR index="msad" sourcetype="ActiveDirectory"

add double quote

0 Karma
Highlighted

Re: Why is the top command not working when searching in two indexes?

New Member

Nope...

This is when the data comes...

(index=dlp OR index=msad) (sourcetype=intel:dlp OR sourcetype=ActiveDirectory)

0 Karma