Splunk Search

coorelated event

rashid47010
Communicator

any body advise me why the below query is not showing the the IP's whereas I am sure that there are some IP's who are bluecoat logs but not in websense logs:

index=websense sourcetype=websense src NOT [search index=bcoat sourcetype="bluecoat:proxysg:access:file" | fields src ]

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

To troubleshot your search start to try your single searches separately and see if there are values in both of them and values that aren't in both of them.

  • index=websense sourcetype=websense src
  • index=bcoat sourcetype="bluecoat:proxysg:access:file" | fields src

In addition, verify that the field src is present in both the searches?

The string "src" that you put before "NOT" means that in the first search you want to search also the word "src" or other?

Bye.
Giuseppe

0 Karma

rashid47010
Communicator

the src field is common for both devices. and I check the logs individually. I have one use case that for sure he is bypassing websense control(means there are no logs on websense for that src IP)

but still now showing any result:
my query is :

index=websense sourcetype=websense NOT [search index=bcoat sourcetype="bluecoat:proxysg:access:file" | fields src ]

0 Karma

gcusello
SplunkTrust
SplunkTrust

does your search run without "NOT"? what result you have?
Bye.
Giuseppe

0 Karma

gokadroid
Motivator

Isn't that your query is doing exactly opposite:

Search IPs in websense log which are NOT in [ IPs in bluecoat logs]

Shouldn't you be doing below if you want *some IP's who are bluecoat logs but not in websense logs:
*
:

Search IPs in bluecoat logs NOT in [ IPs in websense logs ]
0 Karma

rashid47010
Communicator

I am trying now with this query.
shortly I will update you with the results.

index=bcoat sourcetype="bluecoat:proxysg:access:file" NOT [search index=websense | fields src ]

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...