Hi Everyone, I'm new to Splunk and am having difficulty making a simple(ish) query.
I'd like to display select fields from 3 indexes in a table, and need to use the output of a search on one index to search the other two. The end goal is to grab IP addresses from firewall logs, and use them to match hostnames and user names to each firewall event. This searches index=users using the src_ip field from index=firewall:
index=users User!="del*ted" [search index=firewall | fields src_ip ] | table User src_ip | rename User AS user-id | rename src_ip AS ip-address
Here's where I'm having difficulties:
I'd like to search another index,
"network", using the src_ip(s) from
firewall and add the field "hostname"
to the results table.
I want the searches on index=users
and index=network using src_ip from
firewall to search up to 24hrs before
the firewall log time and use the
log closest to the firewall event.
There's another field in the firewall
index I want to add to the search
results called "event_description".
I've tried a few different approaches, including join, and have just not been able to make this all work together. I'd really appreciate any help you guys can give. Thank You!
... View more