Splunk Search

How to correlate an event using two different indexes?

bcjammer03
Explorer

I'm trying to create a query that will provide me with events that use two indexes. The results are to show events where 2 consecutive emails were blocked (by a specific endpoint tool = index1) followed by a successfully sent email (logged by another endpoint tool = index2). 

event/log=((block#1and block#2) and successful sent email)

I've been running into issues-this what I currently have:

index=index1 field1=SMTP action=blocked

| rex field=suid  "(?<UserName>.+?)@"

| eval UserName=upper(UserName)

| rex "fileName"=(?<attachments>.+)\s*fileHash=*+"

| rex field=_raw "(?Subject>(?<=cs\=)(.*)(?=suid\=))"

| rename suid AS Sender act as ACT

| stats count by UserName

| transaction endswith=datasource="index2" maxspan=30min

Any help is appreciated, thanks.

Labels (5)
0 Karma

rafamss
Contributor

Can you explain more about what you want? What I understood is:

The first index have the initial information, like email, user ID, and so on,
The second one is the information related to event stats like blocks, success, etc.

Is that right?

0 Karma

bcjammer03
Explorer

The first index contains data from an endpoint security tool that can block outbound/external emails. The second index contains data from another endpoint tool that archives emails (I can see all successful outbound and inbound emails that are not blocked).

So essentially, I want to see if user ABC123 gets two email blocks and within 30 minutes of those two blocks (index1), sends a successful email that is not blocked (index2). 

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...