https://community.splunk.com/t5/Splunk-Search/relating-AD-logs-with-DHCP/m-p/26452#M5111 <P>Hi,</P> <P>I am trying to add a IP address hint to the Active Directory logs. I know it isn't completely reliable, but it is just to get a general ideal of the IP address the workstations had when they generate some events. Sometimes the IP is already included in the event, but most times it isn't.</P> <P>They way I am trying to implement it is by building a state table with a scheduled query:<BR /> index="dhcp" (description="DNS Update Successful" OR description="Renew") | dedup hostname | outputcsv dhcpstatetable<BR /> And then using a automatic lookup to add a probableip field to the AD events.</P> <P>I have the problema that the outputcsv writes the csv to /var/run which I can't use to create a lookup definition. </P> <P>Is there a better way to do this?</P> Tue, 07 May 2013 14:28:06 GMT krugger 2013-05-07T14:28:06Z https://community.splunk.com/t5/Splunk-Search/relating-AD-logs-with-DHCP/m-p/26452#M5111 <P>Hi,</P> <P>I am trying to add a IP address hint to the Active Directory logs. I know it isn't completely reliable, but it is just to get a general ideal of the IP address the workstations had when they generate some events. Sometimes the IP is already included in the event, but most times it isn't.</P> <P>They way I am trying to implement it is by building a state table with a scheduled query:<BR /> index="dhcp" (description="DNS Update Successful" OR description="Renew") | dedup hostname | outputcsv dhcpstatetable<BR /> And then using a automatic lookup to add a probableip field to the AD events.</P> <P>I have the problema that the outputcsv writes the csv to /var/run which I can't use to create a lookup definition. </P> <P>Is there a better way to do this?</P> Tue, 07 May 2013 14:28:06 GMT https://community.splunk.com/t5/Splunk-Search/relating-AD-logs-with-DHCP/m-p/26452#M5111 krugger 2013-05-07T14:28:06Z https://community.splunk.com/t5/Splunk-Search/relating-AD-logs-with-DHCP/m-p/26453#M5112 <P>outputlookup seems to solve it</P> Tue, 07 May 2013 14:36:06 GMT https://community.splunk.com/t5/Splunk-Search/relating-AD-logs-with-DHCP/m-p/26453#M5112 krugger 2013-05-07T14:36:06Z https://community.splunk.com/t5/Splunk-Search/relating-AD-logs-with-DHCP/m-p/26454#M5113 <P>You can create an empty dummy lookup where you need it and then use the outputlookup command to populate it.</P> <P>There is an example in the documentation of the command: <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Outputlookup">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Outputlookup</A></P> Tue, 07 May 2013 21:54:19 GMT https://community.splunk.com/t5/Splunk-Search/relating-AD-logs-with-DHCP/m-p/26454#M5113 chris 2013-05-07T21:54:19Z