Splunk Search

Combine searches through field

bigrichie90
Path Finder

I have a query that pulls up IPs' but with no hostname. I have a separate query that can correlate each IP to a host name. My question is how can I run that query(find hostname) to each IP found in my first query?

Query2 finds hostname and is correlated to time and IP. It takes IP and time and finds the most recent ASSIGN event that happened before it (thus telling me who's IP that belongs to). This gives me the hostname. I am trying to do this with every IP found in my first query (taking query1 IP and time for EACH event and plugging into query2 to find hostname).

index=query1 | eval event=_time | appendcols [search index=query2 summary=ASSIGN  _time<event ip=src_ip | head 1]

query1=src_ip query2=ip

0 Karma

jimodonald
Contributor

Use a "join" instead of an "appendcols" and get the field names to be consistent.

Try something like this:

index=query1 | eval event=_time | join  [search index=query2 summary=ASSIGN  _time<event |rename ip AS src_ip |  head 1]
0 Karma

bigrichie90
Path Finder

I have tried this query but the problem is, for example, what if someone has had this IP for 2 days? If I was looking to run query1 for the last 15 minutes, it wouldn't pick up the hostname for query2 since it was assigned much earlier.

0 Karma

somesoni2
Revered Legend

What all fields do you need from query1?

0 Karma

bigrichie90
Path Finder

Mainly the IP field but there will be cases I may need more than one field from query1.

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...