Hi all i need to do a search like this:
sourcetype="webseal_access" OR sourcetype="wmi:wineventlog:security" | rename Source_Network_Address as IP | rename IP_Source as IP
where the IP is in a field of another search. How can i do this?
Thanks
If the IP could possibly be in several locations, and you want to normalize them into a field, I like the coalesce command in eval.
sourcetype="webseal_access" OR sourcetype="wmi:wineventlog:security" | eval IP = coalesce(Source_Network_Address,IP_Source)
This says "make a new field called IP, and use the value from the first non-empty field."
http://www.splunk.com/base/Documentation/latest/SearchReference/CommonEvalFunctions
Take a look at the format
command:
http://www.splunk.com/base/Documentation/4.1.5/SearchReference/format