Splunk Search

Attempting to build a baseline computer asset list as a datasource from existing indexes

cfoord
New Member

Hi Everyone,

I hope the smarter folks over here can assist me with a query that has kept me up for days. Hopefully this will be helpful for anyone else trying to accomplish the same thing.

In short: Attempting to build a baseline computer asset list as a datasource from existing indexes

Ok, so lets break the scenario down:

Lets say we have the following 4 indexes:
index=dhcplog (fields: hostname, ip)
index=ad-eventlog (fields: hostname, ip, username, various other security fields)
index=av-logs (fields: ComputerName, ip, user, various other security fields)
index=ad-audit (fields: Sourcehost, ip, username, various other fields) - index built from a weekly AD export.

Now, the goal is to generate a "baseline" asset list, based on computer host names that appear in more than 1 of these indexes in order to verify that the baseline is as accurate as possibl.e Some Non-domain joined stand-alone hosts that contain a AV solution also log hostnames into DHCP/AV (as hostname/SourceHost respectively)

The info from the above "baseline" can then be saved as datasource to be used in further queries/searches.

From the above, I have tried the following query (added in codeblock) to no success as it only lists all the entries and does not perform the required check to verify IF the "Asset" appears in more than 1 index.

|multisearch
[search index=ad-audit host!="" | fields host | rename host AS Asset]
[search index=ad-eventlog host!="" | fields host | rename host AS Asset]
[search index=av-logs ComputerName!="" | fields ComputerName| rename ComputerName AS Asset]
[search index=dhcplog host!="" | fields host | rename host AS Asset]
| dedup Asset
| table Asset

Any help would be greatly appreciated!
Thanks!

0 Karma

to4kawa
Ultra Champion
index=ad-audit OR index=ad-eventlog  OR index=av-logs OR index=dhcplog
| eval Asset=coalesce(hostname, Sourcehost, ComputerName)
| stats dc(index) as Asset_count by Asset
| fields Asset

Hi, How about this?

0 Karma
Get Updates on the Splunk Community!

Expert Tips from Splunk Education, Observability in Action, Plus More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Changes to Splunk Instructor-Led Training Completion Criteria

We’re excited to share an update to our instructor-led training program that enhances the learning experience ...

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

❄️ Welcome the new year with our January lineup of Community Office Hours, Tech Talks, and Webinars! 🎉 ...