About the_dude

the_dude · ‎12-14-2023

It is correct somewhat, I'm trying to 1:1 for the two specific columns. The use it just to start with the two columns matching at first, then another where they do not. Where Qui-gonn Jinn is in both Sith and Jedi indexes and listed in both columns. For some reason I thinking I might be making this more difficult than it needs to be. If the two IDs match in both columns then they are listed with the rest. Hopefully that clear is up. I am still trying to relearn the whole search in Splunk currently so I do apologize.

the_dude · ‎12-14-2023

This was the concept: index-=sith broker sithlord!=darth_maul OR index=jedi domain="jedi.lightside.com" (master!="yoda" AND master!="mace" AND master="Jinn") | where Jname=Sname | table Jname, Sname, strengths, mentor, skill, domain, mission, strength, teacher, actions And index-=sith broker sithlord!=darth_maul OR index=jedi domain="jedi.lightside.com" (master!="yoda" AND master!="mace" AND master="Jinn") | where Jname!=Sname | table Jname, Sname, strengths, mentor, skill, domain, mission, strength, teacher, actions I am trying to get the results where Jname=Sname are the same plus all following columns. This is for a comparison for our analysts and they want the first two columns to match plus following columns. Then a report where they are not matching.

the_dude · ‎12-14-2023

I need to filter out the white noise. index-=sith broker sithlord!=darth_maul OR index=jedi domain="jedi.lightside.com" (master!="yoda" AND master!="mace" AND master="Jinn") If I use the correct one, 75% of it is white noise. I need to use the above to isolate what I need specifically from the indexes. I need to show a 1:1 match plus a few other columns. I was asked to get the former but now they need more.

the_dude · ‎12-14-2023

index=jedi domain="jedi.lightside.com" (master!="yoda" AND master!="mace" AND master="Jinn") | table saber_color, Jname, strengths, mentor, skill, domain, mission index-=sith broker sithlord!=darth_maul | table saber_color, Sname, strength, teacher, actions I need to list where Jname=Sname, but I need to list all columns The third one is where the Jname!=Sname The caveat is I cannot use the join for this query. This helped however I am unable to utilize the index drill down for each in the search otherwise the query is 75% white noise. index=jedi OR index=sith | eval name=coalesce(Jname, Sname) | stats values(name) as names by saber_color strengths | where mvcount(names)=1 Please help.

the_dude · ‎11-18-2023

@bowesmanait worked now I have to figure out how to utilize my drill down to isolate the columns and index heading with my query. Either way thank you.

the_dude · ‎11-15-2023

@bowesmanawill give it a try. Thank you.

the_dude · ‎11-14-2023

Just the Jname and Sname need to match and all the other columns will coalesce. Because of the sheer size of the Sname (I set it up as our windows log index)index it worries me. However if I can find a way to drill down and expedite. index IN (jedi AND sith) | table saber_color, Jname, Sname, strengths, saber_color | where Jname=Sname That is what I am trying. I'll give it a shot with your method. @bowesmana

the_dude · ‎11-14-2023

I am trying to generate three reports with stats. The first is where jedi and sith have matching columns. The third is where jedi and sith do not match. Example: index=jedi | table saber_color, Jname, strengths index-=sith | table saber_color, Sname, strengths I need to list where Jname=Sname The third one is where the Jname!=Sname The caveat is I cannot use the join for this query. Any good ideas?

the_dude · ‎10-30-2023

Thank you for the insight. The "| table * *" were the columns that all match with variances in AD and unix. I have everything broken down specifically per each index in order to have somewhat of a uniform and sanitary environment. I am having to retake a crash course right now in splunk query. Let me try the method you prescribed and we can continue from there. I'll double check my column headers between the three indexes. I will be more precise in my explanation on my next follow up. Thank you. ..update.. index=cyber AND index=AD | table act, devtype, safe, issuer, username, purpose (for cyber) | table audit, e_user, evnt_cat, evnt_tsk, proc_name, (for AD) index=cyber AND index=unix | table act, devtype, safe, issuer, username, purpose (for cyber) | table proc, src, user, msg (for unix) Double checked my data. AD and unix searches are never done together, always cyber and one or the other.

the_dude · ‎10-29-2023

I have three indexes I am trying to join that have at least three similar columns each. I want to table the results in order to generate a report and alert. What would be the fastest method to work around using the join command if possible? Because my environment is built to min specs I need to not utilize something that is not resource heavy. Below is my query the "| table" is where I am having issues. Cyber is my elevated account vault AD is my active directory and the unix is for my redhat environment. I am a little lost currently as I have not played with Splunk in a couple of years. index=cyber AND index=AD AND index=unix | table _eventtime, issuer, requestor, purpose (for cyber) | table user, issuer, elevID, action (for AD) | table user, path, cmd (for unix)

Posts	10
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎10-29-2023

Online Status	Offline
Date Last Visited	‎02-19-2024 06:42 AM

Adding two indexes to one search again

search two indexes specifying two matching columns

Joining indexes for stats results

Re: Adding two indexes to one search again

Re: Adding two indexes to one search again

Re: Adding two indexes to one search again

Adding two indexes to one search again

Re: search two indexes specifying two matching col...

Re: search two indexes specifying two matching col...

Re: search two indexes specifying two matching col...

search two indexes specifying two matching columns

Re: Joining indexes for stats results

Joining indexes for stats results