If your problem is solved, please accept the answer. ... View more

Finally got it working... first, create a lookup table first with the IPs that I want to cross reference: index=nessus severity=critical | stats count by dest_ip | table dest_ip | outputlookup crit_vuln_hosts.csv second, cross reference that table against all of my indexes except for the nessus one: | inputlookup crit_vuln_hosts.csv | fields dest_ip | search NOT [ search index!=nessus | dedup dest_ip | fields dest_ip ] ... View more

I was working my way through both answers 😃 thanks for the help!! ... View more

Assuming that the host field contains the IP of the system that generated the Snort alert (adjust to proper field name if not), this should work: index=snort [index=http status=200 | rename src_ip AS host | fields host] ... View more