If you use join, you will have to join twice, first to get the type of the sending host and secondly to get the type of the receiving host. You can also do it with some fiddly eventstats. Here is a pseudo example of using eventstats | makeresults count=20
| eval hostname="host-".mvindex(split("ABCDEFGHIJKLMNOPQRSTUVWXYZ", ""), random() % 26)
| eval host="host-".mvindex(split("ABCDEFGHIJKLMNOPQRSTUVWXYZ", ""), random() % 26)
| eval destPort=mvindex(split("9995,9996,9997", ","), random() % 3)
| append [
| makeresults count=26
| streamstats c
| eval splunkname="host-".mvindex(split("ABCDEFGHIJKLMNOPQRSTUVWXYZ", ""), c - 1)
| eval type=mvindex(split("Intermediate Forwarder,Indexer", ","), random() % 2)
| fields - c
]
``` The above sets up a data set of 20 rows of send/receive events
and the append makes the 'library' of the 26 possible host types.
Now this logic will 'join' the types to the events ```
| eval host=coalesce(host, splunkname)
| eval hostname=coalesce(hostname, splunkname)
``` join the type to receiving host ```
| eventstats values(type) as receivingType by host
``` join the type to sending hostname ```
| eventstats values(type) as sendingType by hostname
| where isnotnull(destPort)
| stats values(destPort) as destPorts by sendingType receivingType and a similar example using a double join | makeresults count=20
| eval hostname="host-".mvindex(split("ABCDEFGHIJKLMNOPQRSTUVWXYZ", ""), random() % 26)
| eval host="host-".mvindex(split("ABCDEFGHIJKLMNOPQRSTUVWXYZ", ""), random() % 26)
| eval destPort=mvindex(split("9995,9996,9997", ","), random() % 3)
| join hostname [
| makeresults count=26
| streamstats c
| eval splunkname="host-".mvindex(split("ABCDEFGHIJKLMNOPQRSTUVWXYZ", ""), c - 1)
| eval type=mvindex(split("Intermediate Forwarder,Indexer", ","), random() % 2)
| fields - c
| rename splunkname as hostname
]
| rename type as sendingType
| join host [
| makeresults count=26
| streamstats c
| eval splunkname="host-".mvindex(split("ABCDEFGHIJKLMNOPQRSTUVWXYZ", ""), c - 1)
| eval type=mvindex(split("Intermediate Forwarder,Indexer", ","), random() % 2)
| fields - c
| rename splunkname as host
]
| rename type as receivingType
| fields - _time
| stats values(destPort) as destPorts by sendingType receivingType Note that both of these involve append or join, which are not the best commands to use, as they can have subsearch data limitations.
... View more