Splunk Search

Attempting to build a baseline computer asset list as a datasource from existing indexes

cfoord
New Member

Hi Everyone,

I hope the smarter folks over here can assist me with a query that has kept me up for days. Hopefully this will be helpful for anyone else trying to accomplish the same thing.

In short: Attempting to build a baseline computer asset list as a datasource from existing indexes

Ok, so lets break the scenario down:

Lets say we have the following 4 indexes:
index=dhcplog (fields: hostname, ip)
index=ad-eventlog (fields: hostname, ip, username, various other security fields)
index=av-logs (fields: ComputerName, ip, user, various other security fields)
index=ad-audit (fields: Sourcehost, ip, username, various other fields) - index built from a weekly AD export.

Now, the goal is to generate a "baseline" asset list, based on computer host names that appear in more than 1 of these indexes in order to verify that the baseline is as accurate as possibl.e Some Non-domain joined stand-alone hosts that contain a AV solution also log hostnames into DHCP/AV (as hostname/SourceHost respectively)

The info from the above "baseline" can then be saved as datasource to be used in further queries/searches.

From the above, I have tried the following query (added in codeblock) to no success as it only lists all the entries and does not perform the required check to verify IF the "Asset" appears in more than 1 index.

|multisearch
[search index=ad-audit host!="" | fields host | rename host AS Asset]
[search index=ad-eventlog host!="" | fields host | rename host AS Asset]
[search index=av-logs ComputerName!="" | fields ComputerName| rename ComputerName AS Asset]
[search index=dhcplog host!="" | fields host | rename host AS Asset]
| dedup Asset
| table Asset

Any help would be greatly appreciated!
Thanks!

0 Karma

to4kawa
Ultra Champion
index=ad-audit OR index=ad-eventlog  OR index=av-logs OR index=dhcplog
| eval Asset=coalesce(hostname, Sourcehost, ComputerName)
| stats dc(index) as Asset_count by Asset
| fields Asset

Hi, How about this?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...