How to search an index for a hostname using an IP address that was generated from results of a search of a different index?

[srikrame]

I have a search in index1 that give me ip_addresses but no host name. I want to search another index, index2, for the hostname using this IP address.

How can I use the IP addresses from my main search to lookup the respective hostname from another index and output IP addresses and hostname in a table format?

The IP address from my primary search is dynamic and is more than 1.

[niketn]

There are multiple ways of this correlation: transaction, append, appendcols, join, sub search and stats etc. Refer to following Splunk documentation for which Event Correlation to use under various circumstances: http://docs.splunk.com/Documentation/Splunk/latest/Search/Abouteventcorrelation

Using stats command would be optimal for this scenario. Following is what the stats query might look like.

index="index" OR index="index2" ip_adresses="*"| stats values(hostname) by ip_adresses 

If the IP address field names are different then you can use either eval or rename SPL command or create alias for index/sourcetype so that the field names for IP Address become same in both indexes and above search may work.

For more accurate Splunk search field names for both indexes i.e. Index name (and sourcetypes), ip address field, host name field and some of their sample values will be required.

[srikrame]

Thanks for the quick response.
In my case, I want to lookup the hostname from another index based on the ip address.

[niketn]

By hostname do you imply Splunk extracted field host?
If yes can you give some sample data with field names?