topic Re: Using a subsearch in a lookup in Splunk Search

Using a subsearch in a lookup

jwhughes58 — Tue, 20 Apr 2021 21:29:13 GMT

I've got two searches I'm trying to join into one.

| localop | ldapsearch domain=my_domain search="(&(objectCategory=Computer)(userAccountControl:1.2.840.113556.1.4.803:=xxxx))" | table cn, dNSHostName

And

| makeresults | eval fqdn="www.usatoday.com" | lookup dnslookup clienthost AS fqdn OUTPUT clientip as ip

What I would like is a table that has hostname, FQDN, and IP Address. I've tried various subsearch methods to join them, but I must have something off since I either get an error or nothing. Any thoughts?

TIA,

Joe

Re: Using a subsearch in a lookup

bowesmana — Tue, 20 Apr 2021 22:46:22 GMT

or assuming that the cn is the fqdn, then this

Re: Using a subsearch in a lookup

scelikok — Wed, 21 Apr 2021 05:56:05 GMT

Hi @jwhughes58,

You can simply add dnslookup into your first search. There is no need subsearch;

| localop | ldapsearch domain=my_domain search="(&(objectCategory=Computer)(userAccountControl:1.2.840.113556.1.4.803:=xxxx))" | lookup dnslookup clienthost AS dNSHostName OUTPUT clientip as ip | table cn, dNSHostName, ip

Re: Using a subsearch in a lookup

jwhughes58 — Wed, 21 Apr 2021 15:04:11 GMT

Doh! There are times when I forget how Splunk works and try treating it like a programming language.

Re: Using a subsearch in a lookup

jwhughes58 — Wed, 21 Apr 2021 15:06:54 GMT

I see I explained my question badly bowesmana. I was going to update it today with a better explanation, but scelikok answered it. Thanks for the reply.