Getting Data In

How to merge 2 fields to 1 field and correlate 2 sourcetypes with the timestamp and IP address of a user?

seksit
Explorer

Hi

I have 2 sourcetypes: websense_ss and pan:traffic. I want to correlate these 2 sourcetypes with timestamp and IP Address of user(May 2 16:30:00 << This is timestamp pattern of data).

  • I'm try to merge 2 fields to 1 file because 2 sourcetypes have different fields, but it's the same data. Below are the details:

    • Sourcetype websense_ss >> src_host
    • Sourcetype pan:traffic >> src_ip
    • I need to create new field called src_ip_wp
  • I want to compare 2 sourcetypes by correlate data with timestamp and ip address and get an output like this:

before correlation

timestamp Event1

timestamp Event2

Output after correlation
timestamp Event1
timestamp Event2

Thank you so much

Sorry for my poor English

0 Karma

sundareshr
Legend

See if this gives you what you're looking for

For merging the 2 fields, you can use the coalesce function. Like this

your base search here | eval src_ip_wp=coalesce(src_ip, src_host)

To corelate the events based on this new IP and time, try this

your base search here | eval src_ip_wp=coalesce(src_ip, src_host) | stats list(_raw) by src_ip_wp _time 

You can change _raw to the fields that you need.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...