topic Host and ComputerName Mismatch Search in Getting Data In

Host and ComputerName Mismatch Search

loatswil — Mon, 22 Jul 2013 17:50:02 GMT

Can I get some help with a search or report?

We have an issue where some hosts were renamed or cloned and Splunk was not re-installed so the Host does not match the ComputerName.

I know that I can simply update the $SPLUNK_HOME/etc/system/local files to fix the situation but I need to be able to identify these machines out of 500+ hosts and monitor so that it doesn't happen again.

Can someone please post a search that shows all hosts where the "Host" field does NOT match the "ComputerName" field?

I have tried and tried and can't seem to track down the correct search language. It seems simple enough but I'm stuck. Maybe I'm over-thinking it.

Thanks,

Re: Host and ComputerName Mismatch Search

lguinn2 — Mon, 22 Jul 2013 18:41:50 GMT

For Windows: if (1) you are indexing the Windows System Event log and (2) the event log contains a field named ComputerName, you could do this:

sourcetype="WinEventLog:System" 
| where upper(host)!=upper(ComputerName)
| dedup host ComputerName
| table host ComputerName

For Linux, you need to find a log file that contains the host name, and run a similar search.

Re: Host and ComputerName Mismatch Search

hartfoml — Thu, 12 Sep 2013 18:39:41 GMT

Hi I have this problem in my enviorment but the search didn't work.

The host=myhost the Computername=myhost.network.com

this shows in the mismatch above.

I tried this:
sourcetype="WinEventLog:System” | rex "ComputerName\=(?<computerName>.*)\.network" | where upper(host)!=upper(computerName) | dedup host computerName | table host computerName

But it misses the ones where Computer name dosn't not have the FQDN.

Any sugestions on how this would work for both conditions where the ComputerName is FQDN OR ComputerName is netbios?

Re: Host and ComputerName Mismatch Search

hartfoml — Thu, 12 Sep 2013 18:52:05 GMT

I even tried this but the eval command didn't work

sourcetype="WinEventLog:System" | EVAL computerName=if(ComputerName="*.network.*",regex=ComputerName\=(?)\.network,ComputerName) | where upper(host)!=upper(computerName) | dedup host computerName | table host computerName index