coorelated event

[rashid47010]

any body advise me why the below query is not showing the the IP's whereas I am sure that there are some IP's who are bluecoat logs but not in websense logs:

index=websense sourcetype=websense src NOT [search index=bcoat sourcetype="bluecoat:proxysg:access:file" | fields src ]

[gcusello]

To troubleshot your search start to try your single searches separately and see if there are values in both of them and values that aren't in both of them.

• index=websense sourcetype=websense src
• index=bcoat sourcetype="bluecoat:proxysg:access:file" | fields src

In addition, verify that the field src is present in both the searches?

The string "src" that you put before "NOT" means that in the first search you want to search also the word "src" or other?

Bye.
Giuseppe

[rashid47010]

the src field is common for both devices. and I check the logs individually. I have one use case that for sure he is bypassing websense control(means there are no logs on websense for that src IP)

but still now showing any result:
my query is :

index=websense sourcetype=websense NOT [search index=bcoat sourcetype="bluecoat:proxysg:access:file" | fields src ]

[gcusello]

does your search run without "NOT"? what result you have?
Bye.
Giuseppe

[gokadroid]

Isn't that your query is doing exactly opposite:

Search IPs in websense log which are NOT in [ IPs in bluecoat logs]

Shouldn't you be doing below if you want *some IP's who are bluecoat logs but not in websense logs:
*:

Search IPs in bluecoat logs NOT in [ IPs in websense logs ]

[rashid47010]

I am trying now with this query.
shortly I will update you with the results.

index=bcoat sourcetype="bluecoat:proxysg:access:file" NOT [search index=websense | fields src ]