Splunk Search
Highlighted

search where a field is IN another search

Path Finder

Hi all i need to do a search like this:

sourcetype="webseal_access" OR sourcetype="wmi:wineventlog:security" | rename Source_Network_Address as IP | rename IP_Source as IP

where the IP is in a field of another search. How can i do this?
Thanks

Tags (2)
0 Karma
Highlighted

Re: search where a field is IN another search

Motivator
0 Karma
Highlighted

Re: search where a field is IN another search

Path Finder

If the IP could possibly be in several locations, and you want to normalize them into a field, I like the coalesce command in eval.

sourcetype="webseal_access" OR sourcetype="wmi:wineventlog:security" | eval IP = coalesce(Source_Network_Address,IP_Source)

This says "make a new field called IP, and use the value from the first non-empty field."

http://www.splunk.com/base/Documentation/latest/SearchReference/CommonEvalFunctions

0 Karma