topic Re: Search again based on IP in Splunk Search

Search again based on IP

wczimmerman — Tue, 06 May 2014 21:26:58 GMT

Inexperienced with Splunk:

I have a single log server that in collecting all data into one source (file) which Splunk is then digesting (DHCP, etc). I need to search for a particular field in that data (we will call it "cats") and if it matches, use the source_ip field from the matching results to then search for the matching DHCP request line in the same source. In other words, I need to find when a user obtained a DHCP address if they have a matching "cats" field.

Re: Search again based on IP

lguinn2 — Tue, 06 May 2014 21:37:38 GMT

It will help a lot if you can give a line or two of each type of data (obfuscated) - showing the "cats" field and the DHCP request line.

Re: Search again based on IP

MuS — Wed, 07 May 2014 06:28:21 GMT

Hi wczimmerman,

like @lguinn said, logs would help.
Nevertheless take a lock at this superb blog entry by Splunk hero @kbains about using streamstats on some DHCP logs. This will show you a nice way to start looking for cats and DHCP leases....

cheers, MuS