Getting Data In

Find events from two source, when ip1=ip2

dbabanov
Path Finder

Hello!

I have two source. First is IPS, second is ASA.
I want to find unique IP address ("dest_ip") with signature 2245 OR 2700.
My query is:
sourcetype="snort" 2245 OR 2700 | dedup dest_ip | table dest_ip
And now, i want to find events with this unique IP addess in ASA log. In ASA log IP called "srcip".

sourcetype="asa" | append [search sourcetype="snort" 2245 OR 2700 | dedup dest_ip | table dest_ip] | where srcip=destip

I think it is very simple, but I cannot find any answers and solutions to my question. 😞

Thank in advance!

Tags (3)
0 Karma

dbabanov
Path Finder

Thanks for your answer.
First search work perfectly.
But I think, this is not the fastest and optimized search...
Are you agree with me?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this

sourcetype="asa"  [search sourcetype="snort" 2245 OR 2700 | stats count by dest_ip | rename dest_ip as srcip | table srcip | format] 

OR (slower)

 sourcetype="snort" 2245 OR 2700 | stats count by dest_ip | map maxsearches=1000 search="sourcetype=asa src_ip=$dest_ip$"
0 Karma

somesoni2
SplunkTrust
SplunkTrust

I do agree. There best method will be to use lookup table (if no of dest_ips are low, which I believe will not be) OR use of summary indexing. You can schedule a saved search to write into a custom summary index hourly or daily, per your requirement, list of all dest_ip with signature 2245 OR 2700. Once that is setup, in the first query subsearch,instead of searching the main index, you'll just search from summary index data which is already summarize and will be much much faster (personal experience)

http://docs.splunk.com/Documentation/Splunk/6.1/Knowledge/Configuresummaryindexes

0 Karma

dbabanov
Path Finder

Thanks for your answer.
First search work perfectly.
But I think, this is not the fastest and optimized search...
Are you agree with me?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...