Splunk Search

compare 2 field different source type

pgabriel10
Loves-to-Learn Lots

Hello guys,

I have the VPN log and network log.

- In VPN log's it's possible to show IP and USERNAME 
- In Network log it's possible to show what's site the IP access. 

I need to comparare 2 fields ( IP VPN  [src_ip] , IP Network [SRC])  if the field is the same i will add the user.

I Tried this:

 

 

 

index=security host=homolog (sourcetype=vpn_log OR sourcetype=network_log)
| where src_ip=SRC
| eval username_acess=user
| table username_acess,SRC,dst

 

 

 

But doesnt work.

Another way is:

 

 

 

| eval field1=SRC,field2=src_ip 
| eval results1=if(field1=field2,"Yes","No") 
| eval results2=if(match(field1,field2),"Yes","No")
| where match(field1,field2)

 

 

 

I think the error is because the sourcetype is different.

Could you help me ? 

 

 

 

 

Labels (2)
0 Karma

pgabriel10
Loves-to-Learn Lots

I tried but doesnt work. The dst field is blank. Just show the username and SRC. 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The dst field came from your example - if it is not filled, you should look at your extractions

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It doesn't work because splunk works on a pipeline of events - your events come from different source types so the fields extracted in one sourcetype may not exist in the other source type. You can rename one of the fields so it has the same name as the other sourcetype and then either join or use stats to collate the information from the different sourcetypes.

index=security host=homolog (sourcetype=vpn_log OR sourcetype=network_log)
| rename src_ip as SRC
| stats values(user) as username_access values(dst) as dst by SRC
| table username_acess,SRC,dst
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...