I have condition 1 [ index=sample offending_ip="*" ]
I have condition 2 [ index=main source="firewall" ]
I want to find anywere in condition 2 that match condition 1
Do I use Where or join or condition statments
I tried [ index=main source="firewall" | where index=sample offending_ip="*" ]
But this didn't work
Sorry More info on this:
I am trying to find raw data from "Firewall" where IP from "Firewall" manches (Dedup) IP from "offending_ip"
Thnaks for the help so fare. Ill try your sugestions
How do they match? Tell us more specifics. For instance is there an ip field in firewall events whose values match up with the values of offending_ip in the sample events?
Also what are you trying to get for each of those IP's? Do you need the raw text or do you just want to get usernames or session ids or total bytes etc...?
Assuming there are two different IP fields involved, and you want to join on the IP values, and assuming that you want to get, say, the username, the simplest way is with stats.
(index=sample offending_ip=*) OR (index=main source="firewall") | eval status=if(isnull(offending_ip),firewall_ip_field,offending_ip) | stats last(user) by offending_ip
The eval
clause there takes some getting used to but it is normalizing the field names for you, so that stats can zip it up using a consistent field name.
Almost everyone gravitates toward join at first, but it's only rarely the best tool for the job. In short join
is a powerful but obscure and less performant tool for the corner cases that stats
and transaction
cannot handle.