All Apps and Add-ons

How would I join fields from Splunk DB Connect to DB Input to avoid additional DB lookups?

zhatsispgx
Path Finder

Hello,

I am using Splunk DB Connect -> DB Input to import data from a MySQL Table successfully. Rather than create additional automatic lookups/DB Lookups which will be extremely slow against this massive database, how would I join fields that are already indexed from the DB Input to avoid additional DB Lookups?

DB Input data I would like to join on:

source="nessusdb" field: host_ip with source="suricata" field src_ip.

I would like to take the following fields from source="nessusdb" and add them to a search on source="suricata".

something like:

source="suricata" msg="ET *" | table suricata_event, src_ip, nessus_vulnerability

Sorry in advance I am not very good at SPL yet.

Thanks!

0 Karma
1 Solution

mrgibbon
Contributor

Try using:
index=nessusdb OR source=suricata
then using the coalesce command:
|eval src_ip = coalesce(src_ip,host_ip)
Then put in your table command with src_ip and the other fields.

View solution in original post

0 Karma

mrgibbon
Contributor

Try using:
index=nessusdb OR source=suricata
then using the coalesce command:
|eval src_ip = coalesce(src_ip,host_ip)
Then put in your table command with src_ip and the other fields.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...