Splunk Search

Attempting to build a baseline computer asset list as a datasource from existing indexes

cfoord
New Member

Hi Everyone,

I hope the smarter folks over here can assist me with a query that has kept me up for days. Hopefully this will be helpful for anyone else trying to accomplish the same thing.

In short: Attempting to build a baseline computer asset list as a datasource from existing indexes

Ok, so lets break the scenario down:

Lets say we have the following 4 indexes:
index=dhcplog (fields: hostname, ip)
index=ad-eventlog (fields: hostname, ip, username, various other security fields)
index=av-logs (fields: ComputerName, ip, user, various other security fields)
index=ad-audit (fields: Sourcehost, ip, username, various other fields) - index built from a weekly AD export.

Now, the goal is to generate a "baseline" asset list, based on computer host names that appear in more than 1 of these indexes in order to verify that the baseline is as accurate as possibl.e Some Non-domain joined stand-alone hosts that contain a AV solution also log hostnames into DHCP/AV (as hostname/SourceHost respectively)

The info from the above "baseline" can then be saved as datasource to be used in further queries/searches.

From the above, I have tried the following query (added in codeblock) to no success as it only lists all the entries and does not perform the required check to verify IF the "Asset" appears in more than 1 index.

|multisearch
[search index=ad-audit host!="" | fields host | rename host AS Asset]
[search index=ad-eventlog host!="" | fields host | rename host AS Asset]
[search index=av-logs ComputerName!="" | fields ComputerName| rename ComputerName AS Asset]
[search index=dhcplog host!="" | fields host | rename host AS Asset]
| dedup Asset
| table Asset

Any help would be greatly appreciated!
Thanks!

0 Karma

to4kawa
Ultra Champion
index=ad-audit OR index=ad-eventlog  OR index=av-logs OR index=dhcplog
| eval Asset=coalesce(hostname, Sourcehost, ComputerName)
| stats dc(index) as Asset_count by Asset
| fields Asset

Hi, How about this?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...