Splunk Search
Highlighted

How to have a notable event search DHCP logs based on source in FW logs?

New Member

Hello

i have been trying to figure this out for days now.

i have logs coming in from multiple sources that only display IP address (src, dst, etc). what i would like to happen is that when a notable event fires, it searches the DHCP logs to tie a hostname to IP address at time of event. the logs are in separate indexes and i have tried join, transaction etc. i think a problem might be that in the events generating notables they are listed as src, srcip, dst but in the DHCP logs they are shown as destip. i need to map the dest (hostname) field to the ip field. sample below

index=IPS "cat=peer to peer" src=10.139.114.171

index=dhcp sourcetype=dhcpsrvlog dest_ip=10.139.114.171

is it possible to have the notable event spawn a subsearch to correlate this data?

0 Karma
Highlighted

Re: How to have a notable event search DHCP logs based on source in FW logs?

Influencer

What have you tried so far? What was the outcome and what is the expected output? If I understand it correctly, you want to get the data from IPS index based on the destips from dhcp index.. You can use the subsearch and rename the field in your search from desip to src to match the events. something like below

index=IPS "cat=peer to peer" src=10.139.114.171 | [search index=dhcp sourcetype=dhcpsrvlog destip=10.139.114.171 | table destip | rename dest_ip as src]

0 Karma
Highlighted

Re: How to have a notable event search DHCP logs based on source in FW logs?

New Member

thank you for the response. i have tried several variations of what you have provided and it always provides zero results. i can get results with independent searches but as soon as i do a join i get nothing. im thinking it has something to do with the time differential. the IPS event happened 15 minutes ago, but the dhcp request was logged 4 hours ago?

0 Karma
Highlighted

Re: How to have a notable event search DHCP logs based on source in FW logs?

SplunkTrust
SplunkTrust

My recommendation is the common splunk pattern of lookup gen a time based lookup. Assign the lookup on the source type.

So make a search that runs in short intervals to update the time based lookup table.

https://docs.splunk.com/Documentation/Splunk/6.5.2/Knowledge/Configureatime-boundedlookup

Then assign it as an auto lookup to the source type.

http://docs.splunk.com/Documentation/Splunk/6.5.2/Knowledge/Usefieldlookupstoaddinformationtoyoureve...

0 Karma
Highlighted

Re: How to have a notable event search DHCP logs based on source in FW logs?

New Member

thank you for the response. i had considered a lookup table, however this wouldn't allow for historical searches. i guess maybe a combination of both might work

0 Karma
Highlighted

Re: How to have a notable event search DHCP logs based on source in FW logs?

SplunkTrust
SplunkTrust

A time based lookup would allow for historical searches.

0 Karma