Data Filteration from Two Different Sourcetypes

[shreyad]

How do I display data that must be filtered from attributes from 2 different sourcetypes? The search is a multisearch.

This is the query. I would like each of the 4 outputs to be furthered filtered by a "sourcetype2" with an attribute specific to sourcetype2.

|multisearch [search index = index sourcetype="sourcetype1" host=host [| tstats count WHERE index = index sourcetype="sourcetype1" host=host earliest=@mon
| eval earliest=if(count=0,"-1mon@mon","@mon") | table earliest ] ALL MY ATTRIBUTES | eval Coast ="1"] [search index = index sourcetype="sourcetype1" host=host [| tstats count WHERE index = index sourcetype="sourcetype1" host=host earliest=@mon
| eval earliest=if(count=0,"-1mon@mon","@mon") | table earliest ]ALL MY ATTRIBUTES | eval Coast ="2"] [search index = qualys sourcetype="sourcetype1" host=host [| tstats count WHERE index = index = index sourcetype="sourcetype1" host=host earliest=@mon
| eval earliest=if(count=0,"-1mon@mon","@mon") | table earliest ] ALL MY ATTRIBUTES | eval Coast ="3"]
[search index = index sourcetype="sourcetype1" host=host [| tstats count WHERE index = index sourcetype="sourcetype1" host=host earliest=@mon
| eval earliest=if(count=0,"-1mon@mon","@mon") | table earliest ] ALL MY ATTRIBUTES | eval Coast ="4"] | dedup IP | stats count(IP) by Coast

[sudosplunk]

As @jplumsdaine22 suggested, please provide more information for more accurate answers. Meanwhile, try something like this:

index=your_index sourcetype=first_sourcetype OR sourcetype=second_sourcetype fieldname=common_field_value

[hortonew]

I'd eval a new field for whether it should be displayed or not, with criteria from both. For instance: | eval shouldDisplay=case(sourcetype="sourcetype1" AND someField="y", "true", sourcetype="sourcetype2" AND someField="y", "true", 1==1, "false") | where shouldDisplay="true"

[jplumsdaine22]

Hi, it would be helpful if you demonstrated the search you are currently running, and possibly some sample events and what you expect the output of your SPL to be

[shreyad]

|multisearch [search index = index sourcetype="sourcetype1" host=host [| tstats count WHERE index = index sourcetype="sourcetype1" host=host earliest=@mon
| eval earliest=if(count=0,"-1mon@mon","@mon") | table earliest ] ALL MY ATTRIBUTES | eval Coast ="1"] [search index = index sourcetype="sourcetype1" host=host [| tstats count WHERE index = index sourcetype="sourcetype1" host=host earliest=@mon
| eval earliest=if(count=0,"-1mon@mon","@mon") | table earliest ]ALL MY ATTRIBUTES | eval Coast ="2"] [search index = qualys sourcetype="sourcetype1" host=host [| tstats count WHERE index = index = index sourcetype="sourcetype1" host=host earliest=@mon
| eval earliest=if(count=0,"-1mon@mon","@mon") | table earliest ] ALL MY ATTRIBUTES | eval Coast ="3"]
[search index = index sourcetype="sourcetype1" host=host [| tstats count WHERE index = index sourcetype="sourcetype1" host=host earliest=@mon
| eval earliest=if(count=0,"-1mon@mon","@mon") | table earliest ] ALL MY ATTRIBUTES | eval Coast ="4"] | dedup IP | stats count(IP) by Coast