Splunk Search

question regarding correlating two different device logs

somu2014
New Member

hiii

we are having waf and ids the ip passes from ids and waf so i need to correlate the ip address and name fields in both devices... give me some example query regarding this

we have two device like waf and ids in this we

what i need is common ip address in both devices
source address waf signature of waf source address of ids signature of ids

0 Karma

aweitzman
Motivator

Without knowing more details about your setup, the easiest way to do this is probably with a join. If the field names for source address and signature are the same in both (src_addr and sig in this example), you'll want to rename them so they don't overlap:

source=waf | rename src_addr as src_addr_waf, sig as sig_waf | join ip_addr [search source=ids | rename src_addr as src_addr_ids, sig as sig_ids] | table ip_addr src_addr_waf sig_waf src_addr_ids sig_ids

There are limitations to the number of results you can get back from a subsearch (the search in the brackets) that defaults to 50,000, so you'll want to either (a) make sure you have a small enough timeframe where that won't occur, or (b) change your limits.conf file to allow for more. See this page for a description of the limitations in the bottom section:

http://docs.splunk.com/Documentation/Splunk/6.1.1/Search/Aboutsubsearches#Result_output_settings_for...

aweitzman
Motivator

It's a similar answer to above:

source=waf | rename sig as sig_waf | join src_addr [search source=ids | rename sig as sig_ids] | table src_addr sig_ids sig_waf

Use the common field as the field to join on (in this case src_addr) and do the same search on both sources, renaming any output fields that are the same in both so you know which one is which. Then create a table with the common field and any of your output fields.

Read up on the join command here:

http://docs.splunk.com/Documentation/Splunk/6.1.1/SearchReference/Join

0 Karma

somu2014
New Member

Thank you for ur answer and i also have one question

we have two log files one is ids logs and another is waf

we want to check for source address which are common in both ids and waf once we get that list that list of sources which are common in ids and waf we need the list of signature for those sources from both ids and waf

expected output:: src adress is comman in both ids and waf

srcaddress , sig of ids, sig of waf

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...