Getting Data In

How to verify IP addresses from 1 index to IPs of another index to resolve hostnames?

stefanstolk1987
New Member

Hello

I was hoping to find some help regarding a 2 indexes we log in Splunk.
We use BlueCoat logs to log all the TCP actions (requests).
We recently had a large number of infections that may still wander around.
We also log all the AD IP addresses to hostname.

Now I want to check 2 outputs:

index="bcoat_logs" cs_host="123.bot.net" src_ip="?????" date="?????" | table, src_ip, date
index="windows" sourcetype="dhcpsrvlogs" src_ip="?????" date="?????" | table, sAMAccountName

Because the (index) Bcoat logs only output src_ip's to dates, I want to resolve to hostname from the (index) Windows.

I hope someone can help me get started with this.

0 Karma

sundareshr
Legend

Try something like this

index="bcoat_logs" cs_host="123.bot.net" src_ip="?????" date="?????" | join src_ip [search index="windows" sourcetype="dhcpsrvlogs" | table sAMAccountName] | table sAMAccountName src_ip, date

http://docs.splunk.com/Documentation/Splunk/6.3.1511/SearchReference/Join

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...