Splunk Search

How to search an index for a hostname using an IP address that was generated from results of a search of a different index?

srikrame
New Member

I have a search in index1 that give me ip_addresses but no host name. I want to search another index, index2, for the hostname using this IP address.

How can I use the IP addresses from my main search to lookup the respective hostname from another index and output IP addresses and hostname in a table format?

The IP address from my primary search is dynamic and is more than 1.

0 Karma

niketn
Legend

There are multiple ways of this correlation: transaction, append, appendcols, join, sub search and stats etc. Refer to following Splunk documentation for which Event Correlation to use under various circumstances: http://docs.splunk.com/Documentation/Splunk/latest/Search/Abouteventcorrelation

Using stats command would be optimal for this scenario. Following is what the stats query might look like.

index="index" OR index="index2" ip_adresses="*"| stats values(hostname) by ip_adresses 

If the IP address field names are different then you can use either eval or rename SPL command or create alias for index/sourcetype so that the field names for IP Address become same in both indexes and above search may work.

For more accurate Splunk search field names for both indexes i.e. Index name (and sourcetypes), ip address field, host name field and some of their sample values will be required.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

srikrame
New Member

Thanks for the quick response.
In my case, I want to lookup the hostname from another index based on the ip address.

0 Karma

niketn
Legend

By hostname do you imply Splunk extracted field host?
If yes can you give some sample data with field names?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...