Dear fellows, I have two logs and i am looking to do some correlation between them. In the log1, i am looking for IP_x (ex: 2.2.2.2)associated with IP_1 (1.1.1.1), then reuse the value of IP_x (2.2...
See more...
Dear fellows, I have two logs and i am looking to do some correlation between them. In the log1, i am looking for IP_x (ex: 2.2.2.2)associated with IP_1 (1.1.1.1), then reuse the value of IP_x (2.2.2.2) in another search. When i execute, i got nothing. index=* sourcetype=log1 [search index=* sourcetype=log2 src_ip="1.1.1.1" | rex field=_raw "src-ip (?<src-ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | eval src_ip =src-ip | table src_ip ] src_ip if i do this, i got the details index=* sourcetype=log1 2.2.2.2 when i execute manually the search , i got the table with 2.2.2.2 search index=* sourcetype=log2 src_ip="1.1.1.1" | rex field=_raw "src-ip (?<src-ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | eval src_ip =src-ip | table src_ip Any helps will be welcomed