Combine searches through field

[bigrichie90]

I have a query that pulls up IPs' but with no hostname. I have a separate query that can correlate each IP to a host name. My question is how can I run that query(find hostname) to each IP found in my first query?

Query2 finds hostname and is correlated to time and IP. It takes IP and time and finds the most recent ASSIGN event that happened before it (thus telling me who's IP that belongs to). This gives me the hostname. I am trying to do this with every IP found in my first query (taking query1 IP and time for EACH event and plugging into query2 to find hostname).

index=query1 | eval event=_time | appendcols [search index=query2 summary=ASSIGN  _time<event ip=src_ip | head 1]

query1=src_ip query2=ip

[jimodonald]

Use a "join" instead of an "appendcols" and get the field names to be consistent.

Try something like this:

index=query1 | eval event=_time | join  [search index=query2 summary=ASSIGN  _time<event |rename ip AS src_ip |  head 1]

[bigrichie90]

I have tried this query but the problem is, for example, what if someone has had this IP for 2 days? If I was looking to run query1 for the last 15 minutes, it wouldn't pick up the hostname for query2 since it was assigned much earlier.

[somesoni2]

What all fields do you need from query1?

[bigrichie90]

Mainly the IP field but there will be cases I may need more than one field from query1.