Splunk Search

How to search DHCP lease times for specific hosts and how long a host had a specific IP address?

Explorer

Hi All,

I'm currently working on a Splunk search that will show me DHCP leases for specific hosts and how long a host had a specific IP address. I'd like to record the time stamp for the beginning of a lease to a host when 'DHCPACK' is seen, and then go back to that same row in the table and add the lease end time when 'DHCPRELEASE' or 'DHCPEXPIRE' is seen. Is it possible to go back and add to a previous row in a table in Splunk, or is this out of Splunk's capabilities?

Thanks!

Tags (5)
0 Karma

Champion

It's a matter of switching the way you think about it. Splunk's search language can do a lot, the tough part is finding the right commands to transform your data in a way you want to see it.

It's a little hard to give exact searches without knowing what your data looks like, but as a simple example, you could narrow your search to only show the ack release expire data. Then sort the results by host and time to see the timestamps of when each occurred. So assuming that you have the type of event in maybe an action field then something like

[your base search] (action="dhcpack" OR action="dhcprelease" OR action="dhcpexpire") | sort host ip _time | table host ip _time action

And if that looks correct/helpful, you might be able to use autoregress and/or delta to get the time difference between those events. Or you might be able to use eval and/or some multi-value commands/functions to combine/break events up until you see what you've transformed the result set into exactly what you're looking for.

So the answer is yes, it probably can be done. But it's going to be a little more involved than just going back and adding a timestamp unfortunately. If you share some of the actual data, we might be able to help you come up with the search you're looking for.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!