Splunk Search

Is it possible to search 2 different IP fields' rare limits to graph them both and see if any IP addresses overlap?

BITSIntern
Path Finder

Hi

I was wondering if it was possible to search 2 different field's limits. I have tried using join, append, set diff and none have gotten me what I want. What I need is to be able to compare the rare limits of the field ip_source and the field ip_destination such that I can graph them both and see if any ip addresses overlap.

This is my most recent search:

set diff [search host="intern-Studio-1737" | rare limit=20 ip_destination] [search  host="intern-Studio-1737" | rare limit=20 ip_source ]

Please let me know if you can help!

Tags (5)
0 Karma
1 Solution

woodcock
Esteemed Legend

Try this:

[search host="intern-Studio-1737" | rare limit=20 ip_destination | eval joiner=ip_destination] | append [search host="intern-Studio-1737" | rare limit=20 ip_source | eval joiner=ip_source ] | stats values(*) AS * by joiner

This will give you the fields from the events in each source that share the same IP address and drop all the other events' fields.

View solution in original post

stephanefotso
Motivator

Hello! Did you use the join like this?

  ......   host="intern-Studio-1737" | rare limit=20 ip_destination|join  [search host="intern-Studio-1737" | rare limit=20 ip_source ]|table ip_destination ip_source
SGF
0 Karma

BITSIntern
Path Finder

Thanks for the help! This didn't really get me the result I wanted but it helped!

0 Karma

woodcock
Esteemed Legend

Try this:

[search host="intern-Studio-1737" | rare limit=20 ip_destination | eval joiner=ip_destination] | append [search host="intern-Studio-1737" | rare limit=20 ip_source | eval joiner=ip_source ] | stats values(*) AS * by joiner

This will give you the fields from the events in each source that share the same IP address and drop all the other events' fields.

BITSIntern
Path Finder

THANK YOU!

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...