Can I get some help with a search or report?
We have an issue where some hosts were renamed or cloned and Splunk was not re-installed so the Host does not match the ComputerName.
I know that I can simply update the $SPLUNK_HOME/etc/system/local files to fix the situation but I need to be able to identify these machines out of 500+ hosts and monitor so that it doesn't happen again.
Can someone please post a search that shows all hosts where the "Host" field does NOT match the "ComputerName" field?
I have tried and tried and can't seem to track down the correct search language. It seems simple enough but I'm stuck. Maybe I'm over-thinking it.
Thanks,
For Windows: if (1) you are indexing the Windows System Event log and (2) the event log contains a field named ComputerName, you could do this:
sourcetype="WinEventLog:System"
| where upper(host)!=upper(ComputerName)
| dedup host ComputerName
| table host ComputerName
For Linux, you need to find a log file that contains the host name, and run a similar search.
I even tried this but the eval command didn't work
sourcetype="WinEventLog:System"
| EVAL computerName=if(ComputerName="*.network.*",regex=ComputerName\=(?)\.network,ComputerName)
| where upper(host)!=upper(computerName)
| dedup host computerName
| table host computerName index
Hi I have this problem in my enviorment but the search didn't work.
The host=myhost the Computername=myhost.network.com
this shows in the mismatch above.
I tried this:
sourcetype="WinEventLog:System”
| rex "ComputerName\=(?<computerName>.*)\.network"
| where upper(host)!=upper(computerName)
| dedup host computerName
| table host computerName
But it misses the ones where Computer name dosn't not have the FQDN.
Any sugestions on how this would work for both conditions where the ComputerName is FQDN OR ComputerName is netbios?