Hi there, Oldy but goldy 😉  https://community.splunk.com/t5/Splunk-Search/How-to-compare-fields-over-multiple-sourcetypes-without-join/m-p/113477#M29849 Hope this helps ... Cheers, MuS ... View more

Hi dtaylor, You have seen this https://community.splunk.com/t5/Splunk-Search/How-to-compare-fields-over-multiple-sourcetypes-without-join/m-p/113477 since you are already thinking of using `stats`    The important thing is really to get a common field from the various data sets and use that in your stats in your case you could use the field `src_mac` as simple as  | stats values(*) AS * by _time src_mac after your base search should work as long as you get src_mac for all data sets.   Hope this helps ... cheers, MuS   ... View more

Hi there, Take a look at this https://community.splunk.com/t5/Splunk-Search/How-to-compare-fields-over-multiple-sourcetypes-without-join/m-p/113477  Basically, what you need to do is use an eval to normalise the client IP: | eval clientIp = coalesce(vpn.client_ip,matches event.src_ip) and use a 'stats ... by clientIp' Hope this helps ... cheers, MuS ... View more

Please add this  | eval foo=0 | foreach max* [ eval foo='<<FIELD>>'] | fields - max* | rename foo AS max at the end of your SPL 🙂  ... View more