Hello guys, I have the VPN log and network log. - In VPN log's it's possible to show IP and USERNAME - In Network log it's possible to show what's site the IP access. I need to comparare 2 fields ( IP VPN [src_ip] , IP Network [SRC]) if the field is the same i will add the user. I Tried this: index=security host=homolog (sourcetype=vpn_log OR sourcetype=network_log)
| where src_ip=SRC
| eval username_acess=user
| table username_acess,SRC,dst But doesnt work. Another way is: | eval field1=SRC,field2=src_ip
| eval results1=if(field1=field2,"Yes","No")
| eval results2=if(match(field1,field2),"Yes","No")
| where match(field1,field2) I think the error is because the sourcetype is different. Could you help me ?
... View more