Splunk Search

sourcetypes comparison for the similar data with varies filed names

svemurilv
Path Finder

I had 2 different sourcetypes on each contains the Domain, hostname,ipaddress

sourcer1 having data like.

Domain="ausdc.com", Indic="ipaddress" , host="172.20.53.4"
 Domain="ausdc.com",Indic="hostname", host="applicationhost2"

 Domain="sfodc.com", Indic="ipaddress" , host="172.21.53.4"
 Domain="sfodc.com",Indic="hostname", host="applicationhost4"

 Domain="sfodc.com", Indic="ipaddress" , host="172.21.53.7"
 Domain="sfodc.com",Indic="hostname", host="applicationhost8"

source2 having data like

Domain="ausdc.com", host="applicationhost2" , ipadd="172.20.53.4"
Domain="sfodc.com" , host="applicationhost4",  ipadd="172.20.53.4"
Domain="ausdc.com" , host="applicationhost8",  ipadd="172.21.53.7"

is there any way to compare discriminates between 2 data sourcees. like if the indic=hostname and compare that host in the second sourcertype and match with the domain and ipaddress. if the host domain and ip exist in both places true or other wise false

Tags (2)
0 Karma

poete
Builder

Hello @svemurilv,

is it a typo or do you have both Indic, with capital i and indic in the data?

Assuming this is the case, you can try something like this:

index=<firstIndex> Indic="hostname"|join domain host [search index=<secondIndex>]

This will associate, if existing, the ipadd of the second source to the result of the first search, with matching domain and host.

0 Karma

svemurilv
Path Finder

you are right using the join or append we could merge the data where is the comparison between the sourcetype1 Indic="ipaddress" with sourcetype2 ipadd and domain? in my recently added example there is a difference between the 2 source records in applicationhost8 domain is not going to be match there i want to find those unmatched records

0 Karma

poete
Builder
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...