Splunk Search

show only infected with vulnerability on 1 machine

New Member


I am a newbie in splunk

I have this one use case I am trying. search for a machine that have malware infection AND it has a vulnerability. anyone can give me pointers the best search to do it?

(sourcetype="vulnscan" severity=critical) OR sourcetype="avscan" | table av_threatname severity hostname | eval infectedandvulnerable=coalesce(av_threatname,severity)

Tags (1)
0 Karma


You have to use two searches and join the results of them.

Assuming your individual sourcetypes have the hostname field in common (you have to have one common field in both searches, otherwise you will have to evalthem to be identical) you may use this search:

 sourcetype=vulnscan severity=critical | table hostname | join hostname [search sourcetype=avscan] 

For more info on the join command, check => http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Join

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...