Splunk Search

Is it possible to search 2 different IP fields' rare limits to graph them both and see if any IP addresses overlap?

BITSIntern
Path Finder

Hi

I was wondering if it was possible to search 2 different field's limits. I have tried using join, append, set diff and none have gotten me what I want. What I need is to be able to compare the rare limits of the field ip_source and the field ip_destination such that I can graph them both and see if any ip addresses overlap.

This is my most recent search:

set diff [search host="intern-Studio-1737" | rare limit=20 ip_destination] [search  host="intern-Studio-1737" | rare limit=20 ip_source ]

Please let me know if you can help!

Tags (5)
0 Karma
1 Solution

woodcock
Esteemed Legend

Try this:

[search host="intern-Studio-1737" | rare limit=20 ip_destination | eval joiner=ip_destination] | append [search host="intern-Studio-1737" | rare limit=20 ip_source | eval joiner=ip_source ] | stats values(*) AS * by joiner

This will give you the fields from the events in each source that share the same IP address and drop all the other events' fields.

View solution in original post

stephanefotso
Motivator

Hello! Did you use the join like this?

  ......   host="intern-Studio-1737" | rare limit=20 ip_destination|join  [search host="intern-Studio-1737" | rare limit=20 ip_source ]|table ip_destination ip_source
SGF
0 Karma

BITSIntern
Path Finder

Thanks for the help! This didn't really get me the result I wanted but it helped!

0 Karma

woodcock
Esteemed Legend

Try this:

[search host="intern-Studio-1737" | rare limit=20 ip_destination | eval joiner=ip_destination] | append [search host="intern-Studio-1737" | rare limit=20 ip_source | eval joiner=ip_source ] | stats values(*) AS * by joiner

This will give you the fields from the events in each source that share the same IP address and drop all the other events' fields.

BITSIntern
Path Finder

THANK YOU!

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...