Splunk Search

Combine searches through field

bigrichie90
Path Finder

I have a query that pulls up IPs' but with no hostname. I have a separate query that can correlate each IP to a host name. My question is how can I run that query(find hostname) to each IP found in my first query?

Query2 finds hostname and is correlated to time and IP. It takes IP and time and finds the most recent ASSIGN event that happened before it (thus telling me who's IP that belongs to). This gives me the hostname. I am trying to do this with every IP found in my first query (taking query1 IP and time for EACH event and plugging into query2 to find hostname).

index=query1 | eval event=_time | appendcols [search index=query2 summary=ASSIGN  _time<event ip=src_ip | head 1]

query1=src_ip query2=ip

0 Karma

jimodonald
Contributor

Use a "join" instead of an "appendcols" and get the field names to be consistent.

Try something like this:

index=query1 | eval event=_time | join  [search index=query2 summary=ASSIGN  _time<event |rename ip AS src_ip |  head 1]
0 Karma

bigrichie90
Path Finder

I have tried this query but the problem is, for example, what if someone has had this IP for 2 days? If I was looking to run query1 for the last 15 minutes, it wouldn't pick up the hostname for query2 since it was assigned much earlier.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

What all fields do you need from query1?

0 Karma

bigrichie90
Path Finder

Mainly the IP field but there will be cases I may need more than one field from query1.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...