Attempting to build a baseline computer asset list as a datasource from existing indexes

[cfoord]

Hi Everyone,

I hope the smarter folks over here can assist me with a query that has kept me up for days. Hopefully this will be helpful for anyone else trying to accomplish the same thing.

In short: Attempting to build a baseline computer asset list as a datasource from existing indexes

Ok, so lets break the scenario down:

Lets say we have the following 4 indexes:
index=dhcplog (fields: hostname, ip)
index=ad-eventlog (fields: hostname, ip, username, various other security fields)
index=av-logs (fields: ComputerName, ip, user, various other security fields)
index=ad-audit (fields: Sourcehost, ip, username, various other fields) - index built from a weekly AD export.

Now, the goal is to generate a "baseline" asset list, based on computer host names that appear in more than 1 of these indexes in order to verify that the baseline is as accurate as possibl.e Some Non-domain joined stand-alone hosts that contain a AV solution also log hostnames into DHCP/AV (as hostname/SourceHost respectively)

The info from the above "baseline" can then be saved as datasource to be used in further queries/searches.

From the above, I have tried the following query (added in codeblock) to no success as it only lists all the entries and does not perform the required check to verify IF the "Asset" appears in more than 1 index.

|multisearch
[search index=ad-audit host!="" | fields host | rename host AS Asset]
[search index=ad-eventlog host!="" | fields host | rename host AS Asset]
[search index=av-logs ComputerName!="" | fields ComputerName| rename ComputerName AS Asset]
[search index=dhcplog host!="" | fields host | rename host AS Asset]
| dedup Asset
| table Asset

Any help would be greatly appreciated!
Thanks!

[to4kawa]

index=ad-audit OR index=ad-eventlog  OR index=av-logs OR index=dhcplog
| eval Asset=coalesce(hostname, Sourcehost, ComputerName)
| stats dc(index) as Asset_count by Asset
| fields Asset

Hi, How about this?