About kirkj

kirkj · ‎06-21-2024

Okay let me back up. One sourcetype contains the correlation logs with src_ip as it's primary identifier. the other sourcetype is our threat logs where we see far more data about destination, url, app, etc. I want to create a search that takes the IPs from the correlation logs and looks for the same src_ip in the threat logs within a range of 1-2 hours and returns a detailed table describing what could have caused the correlation event to be created. Is this possible to do without using an outputlookup? Also this index has a datamodel that I could leverage where nodenames are log.threat and log.correlation

kirkj · ‎06-21-2024

I'm trying to create a search where I take a small list of IPs from sourcetype A and compare them against a larger set of IPs in sourcetype B. I will then make a table using fields from sourcetype B that do not exist in sourcetype A to create a more detailed look of the events involving the IP. Is there a way to do this without using a lookup table? index=paloalto (sourcetype=sourcetype_B OR sourcetype=sourcetype_A) | eval small_tmp=case(log_type="CORRELATION", src_ip) | eval large_tmp=case(log_type!="CORRELATION", src_ip) | where match(small_tmp, large_tmp) | table field A, field B, field C

Posts	2
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎09-23-2021

Online Status	Offline
Date Last Visited	‎06-21-2024 02:52 PM

splunk match between different sourcetypes

Re: splunk match between different sourcetypes

splunk match between different sourcetypes

Are you a member of the Splunk Community?

splunk match between different sourcetypes

Re: splunk match between different sourcetypes

splunk match between different sourcetypes