Splunk Search

Attempting to build a baseline computer asset list as a datasource from existing indexes

cfoord
New Member

Hi Everyone,

I hope the smarter folks over here can assist me with a query that has kept me up for days. Hopefully this will be helpful for anyone else trying to accomplish the same thing.

In short: Attempting to build a baseline computer asset list as a datasource from existing indexes

Ok, so lets break the scenario down:

Lets say we have the following 4 indexes:
index=dhcplog (fields: hostname, ip)
index=ad-eventlog (fields: hostname, ip, username, various other security fields)
index=av-logs (fields: ComputerName, ip, user, various other security fields)
index=ad-audit (fields: Sourcehost, ip, username, various other fields) - index built from a weekly AD export.

Now, the goal is to generate a "baseline" asset list, based on computer host names that appear in more than 1 of these indexes in order to verify that the baseline is as accurate as possibl.e Some Non-domain joined stand-alone hosts that contain a AV solution also log hostnames into DHCP/AV (as hostname/SourceHost respectively)

The info from the above "baseline" can then be saved as datasource to be used in further queries/searches.

From the above, I have tried the following query (added in codeblock) to no success as it only lists all the entries and does not perform the required check to verify IF the "Asset" appears in more than 1 index.

|multisearch
[search index=ad-audit host!="" | fields host | rename host AS Asset]
[search index=ad-eventlog host!="" | fields host | rename host AS Asset]
[search index=av-logs ComputerName!="" | fields ComputerName| rename ComputerName AS Asset]
[search index=dhcplog host!="" | fields host | rename host AS Asset]
| dedup Asset
| table Asset

Any help would be greatly appreciated!
Thanks!

0 Karma

to4kawa
Ultra Champion
index=ad-audit OR index=ad-eventlog  OR index=av-logs OR index=dhcplog
| eval Asset=coalesce(hostname, Sourcehost, ComputerName)
| stats dc(index) as Asset_count by Asset
| fields Asset

Hi, How about this?

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...