topic Re: Trying to Find All Names that Match a Name in a Field in Splunk Search

Trying to Find All Names that Match a Name in a Field

atebysandwich — Thu, 12 Oct 2023 15:28:22 GMT

I have a field called DNS whos field values contain the hostname in the lookup. There is also another field called Identified_Host that has similar values. I will show the difference below:

DNS	Identified_Host
host1.domain.com	host1.domain.com
host1-admin.domain.com	host1.domain.com
host1-mgt.domain.com	host1.domain.com
host2.domain.com	host2.domain.com
host2-admin.com	host2.domain.com
host2-mgt.admin.com	host2.domain.com
host3.domain.com	host3.domain.com
host3-admin.com	host3.domain.com

From this example. it's shown that Indetified_Host is the main name of the host. I need to find out which hosts in Identified_Hosts have values in DNS with the same name but also end with -admin and/or -mgt.

Re: Trying to Find All Names that Match a Name in a Field

yeahnah — Thu, 12 Oct 2023 22:11:07 GMT

Hi @atebysandwich

I'm not 100% sure I understand what you are trying to do but does this run anywhere example help...

| makeresults | eval _raw="DNS,Identified_Host host1.domain.com,host1.domain.com host1-admin.domain.com,host1.domain.com host1-mgt.domain.com,host1.domain.com host2.domain.com,host2.domain.com host2-admin.com,host2.domain.com host2-mgt.admin.com,host2.domain.com host3.domain.com,host3.domain.com host3-admin.com,host3.domain.com" | multikv forceheader=1 | table DNS Identified_Host ```^^^ dummy events ^^^``` | where DNS!=Identified_Host | stats values(DNS) BY Identified_Host

Re: Trying to Find All Names that Match a Name in a Field

yuanliu — Sat, 14 Oct 2023 08:37:06 GMT

I get a rough idea about what the OP wants:

The lowest level domain in DNS must be that in Identified_Host + "-admin" or "-mgt", and
All upper level domains in DNS and those in Identified_Host are identical.

If this is correct, here is a literal interpretation.

| foreach DNS Identified_Host [rex field=<<FIELD>> "(?<<<FIELD>>_low>[^\.]+).(?<<<FIELD>>_up>.+)"] | where match(DNS_low, "^". Identified_Host_low. "-(admin|mgt)$") AND DNS_up == Identified_Host_up | fields - *_low *_up

Pro tip: You can do volunteers here a great favor if you not just describe the data, but also demonstrate what is desired result, then explain the logic between data and desired result.

Using the data emulation @yeahnah gives, the result from this search is

DNS	Identified_Host
host1-admin.domain.com	host1.domain.com
host1-mgt.domain.com	host1.domain.com

Are these what you expect?