How to write a seach query with 2 searches

[TomCollick]

I need to know how to write a search query with 2 searches where the second search takes the value of the field, IP address, in the first search part to find a hostname that goes with the ip found and displays the ipaddress and hostname results in a table together.

[dwaddle]

You might be more satisfied with a lookup table for ip_address to hostname. This can be done easily with a CSV hosts file, or be tied into DNS lookups automatically. See http://www.splunk.com/base/Documentation/latest/Knowledge/Addfieldsfromexternaldatasources for information on setting either a static or dynamic lookup.

[Ant1D]

Something like this should work:

your_1st_search | join type=left ip_address [search your_2nd_search | fields ip_address hostname]