hi try this:
index=http status=200 src_ip=*|table src_ip|join[search index=snort| table * ]
Assuming that the host
field contains the IP of the system that generated the Snort alert (adjust to proper field name if not), this should work:
index=snort [index=http status=200 | rename src_ip AS host | fields host]
hi try this:
index=http status=200 src_ip=*|table src_ip|join[search index=snort| table * ]