Getting Data In

How to get DHCP scope information in DHCP logs into Splunk?

kiran331
Builder

Hi

How can I get the DHCP scope information in DHCP logs, or is there way to get that information into Splunk and correlate?

Tags (2)

christian_clout
Explorer

Hi,

I had the same question and ended up creating and using a custom TA for our Windows 2008 R2 based DHCP servers.

It's rather simple. It's a scripted input which runs on those DHCP host via their universal forwarder and performs:

netsh dhcp server show mibinfo

This shows all scopes, number of addresses in use/free and pending offers for the DHCP server which I then index in Splunk.

0 Karma

kiran331
Builder

Thanks for response! I tried this one, It is not showing the Scope names, Do you know how to get the scope names? It showing sub nets and use/free..

0 Karma

christian_clout
Explorer

Hi Kiran331,

The information is little all over the place, at least in my case. 🙂

I get mine from Active Directory and then correlate them together.

So for example, from the output of netsh dhcp server show mibinfo:

Subnet = 10.11.12.0.
        No. of Addresses in use = 0.
        No. of free Addresses = 1.
        No. of pending offers = 0.

And the following from my Active Directory entries for subnets (Base DN="CN=Subnets,CN=Sites,CN=Configuration,DC=your,DC=company,DC=com", Filter="(&(objectClass=subnet))"):

siteObject,name,description
"MY_SITE_CODE","10.11.12.0/24","My Company Site ABC Scope"

Note: You can use SA-LDAPSearch to query your Active Directory or a custom script (I use perl).

Then you should be able to get the scope IP range, the site (or whatever) it belongs to and a nice description for it.

Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...