Splunk Search

How to search DHCP lease times for specific hosts and how long a host had a specific IP address?


Hi All,

I'm currently working on a Splunk search that will show me DHCP leases for specific hosts and how long a host had a specific IP address. I'd like to record the time stamp for the beginning of a lease to a host when 'DHCPACK' is seen, and then go back to that same row in the table and add the lease end time when 'DHCPRELEASE' or 'DHCPEXPIRE' is seen. Is it possible to go back and add to a previous row in a table in Splunk, or is this out of Splunk's capabilities?


Tags (5)
0 Karma


It's a matter of switching the way you think about it. Splunk's search language can do a lot, the tough part is finding the right commands to transform your data in a way you want to see it.

It's a little hard to give exact searches without knowing what your data looks like, but as a simple example, you could narrow your search to only show the ack release expire data. Then sort the results by host and time to see the timestamps of when each occurred. So assuming that you have the type of event in maybe an action field then something like

[your base search] (action="dhcpack" OR action="dhcprelease" OR action="dhcpexpire") | sort host ip _time | table host ip _time action

And if that looks correct/helpful, you might be able to use autoregress and/or delta to get the time difference between those events. Or you might be able to use eval and/or some multi-value commands/functions to combine/break events up until you see what you've transformed the result set into exactly what you're looking for.

So the answer is yes, it probably can be done. But it's going to be a little more involved than just going back and adding a timestamp unfortunately. If you share some of the actual data, we might be able to help you come up with the search you're looking for.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...