I want to know if it is possible to use a join command with inputlookup instead of a lookup to join data between an index and a lookup table.
Index=firewalls |join type=inner overwrite=false dstip [inputlookup maliciousIP.csv] |stats count srcip by dstip, malwareName
| join type overwrite=false srcip [inputlookup UserIP.csv] |table count, dstip, malwareName, srcip, username,
The UserIP.csv is generated every hour after this the search will run.
Fyi this is not the exact search, but just an example. The reason I want to use join instead of lookup is that the lookup list has many additional columns and I want to keep the search as simple and short as possible and want to get some input to see how others handle this..
Hope to get some ideas from this.
... View more
I was hoping to find some help regarding a 2 indexes we log in Splunk.
We use BlueCoat logs to log all the TCP actions (requests).
We recently had a large number of infections that may still wander around.
We also log all the AD IP addresses to hostname.
Now I want to check 2 outputs:
index="bcoat_logs" cs_host="123.bot.net" src_ip="?????" date="?????" | table, src_ip, date
index="windows" sourcetype="dhcpsrvlogs" src_ip="?????" date="?????" | table, sAMAccountName
Because the (index) Bcoat logs only output src_ip's to dates, I want to resolve to hostname from the (index) Windows.
I hope someone can help me get started with this.
... View more