We are creating assets inventory using different logs in Splunk.
For this purpose, we first created list of “nt_host” and “owner” using Cisco ISE:
index=iseindex….. |table nt_host owner” | dedup nt_host | outputlookup ise_hosts.csv
We are getting proper expecterd ise_hosts csv file as below.
nt_host owner
ASSET-1 USER1
ASSET2 USER2
ASSET3 USER3
We now use this csv file to get owner information in dhcp logs as below:
index=dhcpindex .... |lookup ise_hosts nt_host output owner | table nt_host ip owner | dedup nt_host | outputlookup final.csv
But we are getting the same owner multiple times as attached. Please assist.
