Host and ComputerName Mismatch Search

[loatswil]

Can I get some help with a search or report?

We have an issue where some hosts were renamed or cloned and Splunk was not re-installed so the Host does not match the ComputerName.

I know that I can simply update the $SPLUNK_HOME/etc/system/local files to fix the situation but I need to be able to identify these machines out of 500+ hosts and monitor so that it doesn't happen again.

Can someone please post a search that shows all hosts where the "Host" field does NOT match the "ComputerName" field?

I have tried and tried and can't seem to track down the correct search language. It seems simple enough but I'm stuck. Maybe I'm over-thinking it.

Thanks,

[lguinn2]

For Windows: if (1) you are indexing the Windows System Event log and (2) the event log contains a field named ComputerName, you could do this:

sourcetype="WinEventLog:System" 
| where upper(host)!=upper(ComputerName)
| dedup host ComputerName
| table host ComputerName

For Linux, you need to find a log file that contains the host name, and run a similar search.

[hartfoml]

I even tried this but the eval command didn't work

sourcetype="WinEventLog:System"
| EVAL computerName=if(ComputerName="*.network.*",regex=ComputerName\=(?)\.network,ComputerName)
| where upper(host)!=upper(computerName)
| dedup host computerName
| table host computerName index

[hartfoml]

Hi I have this problem in my enviorment but the search didn't work.

The host=myhost the Computername=myhost.network.com

this shows in the mismatch above.

I tried this:
sourcetype="WinEventLog:System”
| rex "ComputerName\=(?<computerName>.*)\.network"
| where upper(host)!=upper(computerName)
| dedup host computerName
| table host computerName

But it misses the ones where Computer name dosn't not have the FQDN.

Any sugestions on how this would work for both conditions where the ComputerName is FQDN OR ComputerName is netbios?