Getting Data In

Host and ComputerName Mismatch Search

loatswil
Path Finder

Can I get some help with a search or report?

We have an issue where some hosts were renamed or cloned and Splunk was not re-installed so the Host does not match the ComputerName.

I know that I can simply update the $SPLUNK_HOME/etc/system/local files to fix the situation but I need to be able to identify these machines out of 500+ hosts and monitor so that it doesn't happen again.

Can someone please post a search that shows all hosts where the "Host" field does NOT match the "ComputerName" field?

I have tried and tried and can't seem to track down the correct search language. It seems simple enough but I'm stuck. Maybe I'm over-thinking it.

Thanks,

Tags (2)

lguinn2
Legend

For Windows: if (1) you are indexing the Windows System Event log and (2) the event log contains a field named ComputerName, you could do this:

sourcetype="WinEventLog:System" 
| where upper(host)!=upper(ComputerName)
| dedup host ComputerName
| table host ComputerName

For Linux, you need to find a log file that contains the host name, and run a similar search.

0 Karma

hartfoml
Motivator

I even tried this but the eval command didn't work

sourcetype="WinEventLog:System"
| EVAL computerName=if(ComputerName="*.network.*",regex=ComputerName\=(?)\.network,ComputerName)
| where upper(host)!=upper(computerName)
| dedup host computerName
| table host computerName index

0 Karma

hartfoml
Motivator

Hi I have this problem in my enviorment but the search didn't work.

The host=myhost the Computername=myhost.network.com

this shows in the mismatch above.

I tried this:
sourcetype="WinEventLog:System”
| rex "ComputerName\=(?<computerName>.*)\.network"
| where upper(host)!=upper(computerName)
| dedup host computerName
| table host computerName

But it misses the ones where Computer name dosn't not have the FQDN.

Any sugestions on how this would work for both conditions where the ComputerName is FQDN OR ComputerName is netbios?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...