sourcetype=campusmgr earliest=-72h latest=+72h [search sourcetype=msdhcp earliest=03/10/2013:12:40:00 latest=03/10/2013:15:40:00 | eval dest_ip=if (match(sourcetype,"pan:traffic"),src_ip,"") [search sourcetype=pan:traffic src_translated_port=##### src_translated_ip=###.###.##.## earliest=03/10/2013:12:40:00 latest=03/10/2013:15:40:00 | return 10 src_ip] | return 10 dest_ip] | chart count by user | sort - count Error in 'eval' command: The operator at '(src_ip="###.###.##.##") OR (src_ip="###.###.##.##") OR (src_ip="###.###.##.##") OR (src_ip="###.###.##.##")' is invalid. Can anyone tell me what I'm doing wrong here? *The sourcetype=src_ip in pan:traffic appears as dest_ip in sourcetype=msdhcp. *The dest_mac in sourcetype=msdhcp appears as src_mac in sourcetype=campusmgr. ... View more

I am a new Splunk user who uses Splunk to find infected hosts on our network. I currently run 3 separate searches to pinpoint the users but would like to combine them into one with the goal of ultimately having this e-mailed to myself. These are the following searches: sourcetype=pan:traffic src_translated_port=##### src_translated_ip=###.###.##.## earliest=11/02/2012:23:00:00 latest=11/03/2012:00:23:00 I then review these results to find the src_ip needed to run the subsequent searches. Using the src_ip, I then run this search: sourcetype=msdhcp earliest=11/02/2012:23:00:00 latest=11/03/2012:00:23:00 src_ip=###.###.##.### I then review these results to find the MAC address associated with the first two searches. Using the MAC address, I then run this search to determine the user associated with the MAC: sourcetype=campusmgr earliest=11/02/2012:23:00:00 latest=11/03/2012:00:23:00 ##:##:##:##:##:## Is there a way to combine these searches into one using map search or the eval commands? Any insight would be appreciated. Thanks ... View more