search where a field is IN another search

Question

Hi all i need to do a search like this:

sourcetype="webseal_access" OR sourcetype="wmi:wineventlog:security" | rename Source_Network_Address as IP | rename IP_Source as IP

where the IP is in a field of another search. How can i do this?
Thanks

Answer 1

0	Take a look at the `format` command: http://www.splunk.com/base/Documentation/4.1.5/SearchReference/format link answered 18 Oct '10, 13:56 southeringtonp ♦ 4.9k●2●5●24 accept rate: 35%

Answer 2

If the IP could possibly be in several locations, and you want to normalize them into a field, I like the coalesce command in eval.

sourcetype="webseal_access" OR sourcetype="wmi:wineventlog:security" | eval IP = coalesce(Source_Network_Address,IP_Source)

This says "make a new field called IP, and use the value from the first non-empty field."