Hi everybody,
I tried to find solution with questions who has ever asked but I don't find my answers :=/
I want to correlate information about two different sourcetype (or source) with Splunk web manager.
My Active directory give me Client Address x.x.x.x (field Client_Address) and User Name Joe (field User_Name). sourcetype is WMI:WinEventLog:Security
My router give me who go away of network (who make request out of network). Informations are : IP Adresse source and destination (field for address source are adresse_syslog). sourcetype is syslog.
How I can make to see User_Name who leave network ? My log give me IP address who "leave" but I want to correlate with AD's log :=/
I tried with commands such as :
sourcetype="WMI:WinEventLog:Security" OR sourcetype="syslog" | transaction adresse_syslog User_Name
192.168.0.50| JOIN type=left date_year date_month date_mday date_hour date_minute date_second [ search WAN] | fields User_Name adresse_syslog
But, I want to have graph with for example, X name made command "ping" out of network (thus he "leave" network).
Is it possible to correlate informations such as I want ?
And, is it possible to make graph about this information ?
Finally, is it possible to have a file with all of name of AD and Splunk read this file, and search into log who make request out of network and create graphe with name and destination of request ? (and the better are : file with name and file with destination request)
Sorry if this is not very understandable...
Thx for all.
