I am trying to correlate 2 sets of data together via join search statement, however I need to do a join based on 2 main variables ("vpnIp ON Address" AND " ts ON event_timestamp") on both sets of data.
An example would be the following:
I would like to join data from the following raw line:
Data Set 1: search (host=$host1 HostInfoParser)
Jul 20 22:20:45 $my_host HostInfoParser: [WorkstationInfo] loggedOnUser=MY-Domain\my_pc systemModel=MacBook serviceTag=123456abc systemHostname=my_pc_MacBook vpnIp=220.127.116.119 ts=20120720_22:20:45
to another data set below:
Data Set 2: search (host=$host2 firewall_code)
Jul 20 22:20:48:my_firewall:[local7][warning]: %firewall_code: Group User IP <$external_ip> Address <18.104.22.1689> assigned to session
to produce joined sets of data similar to the following below:
host=$host1 HostInfoParser | join vpnIp [search host=$host2 %firewall_code ] | top loggedOnUser,systemHostname,vpnIp,systemModel,serviceTag,vpnGroup
loggedOnUser systemHostname vpnIp systemModel serviceTag vpnGroup
MY-Domain\my_pc my_pc_MacBook 22.214.171.1249 MacBook 123456abc my_group
Right now we have the current join above working with the "vpnIP ON Address" portion of the join.
I would like to join based on both the vpnIp (i.e. 126.96.36.1999) and the time of the event generated (ts ON event_timestamp). In the example above, the timestamp shown if off by a few seconds.
What would be the best way to overcome what appears to be to be a minor obstacle? Not sure how to match the times up correctly when the timestamp between the 2 events are off by a few seconds.
Any help you can provide in this would be great.
... View more