Splunk Search

Subsearch for Multiple Indexes with Localize?

bobjacks
New Member

Hi Everyone, I'm new to Splunk and am having difficulty making a simple(ish) query.

I'd like to display select fields from 3 indexes in a table, and need to use the output of a search on one index to search the other two. The end goal is to grab IP addresses from firewall logs, and use them to match hostnames and user names to each firewall event. This searches index=users using the src_ip field from index=firewall:

index=users User!="del*ted" [search index=firewall | fields src_ip ] | table User src_ip | rename User AS user-id | rename src_ip AS ip-address

Here's where I'm having difficulties:

  • I'd like to search another index, "network", using the src_ip(s) from firewall and add the field "hostname" to the results table.
  • I want the searches on index=users and index=network using src_ip from firewall to search up to 24hrs before the firewall log time and use the log closest to the firewall event.
  • There's another field in the firewall index I want to add to the search results called "event_description".

I've tried a few different approaches, including join, and have just not been able to make this all work together. I'd really appreciate any help you guys can give. Thank You!

Tags (1)
0 Karma

bobjacks
New Member

Thanks gkanapathy, this definitely points me in the right direction! I'll give this a try and report back. 😃

0 Karma

gkanapathy
Splunk Employee
Splunk Employee
index=firewall OR (index=users User!=del*ted") OR index=network
| stats latest(event_description) as event_description latest(User) as user-id latest(hostname) as hostname by src_ip

is probably close, though you'll get src_ip and events from before your desired time range. You can actually do something like this:

(earliest=-10h index=firewall) OR (earliest=-34h ((index=users User!=del*ted") OR index=network)) 
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...