Join on this field OR that field

[bcyates]

Basically I am trying to find hosts on a csv, not sending data to splunk.

The problem is, we have to account for devices that come over with either the short name, FQDN, or the IP as the host value in Splunk.

So essentially, I would like to join on the field host OR the field IP

I have this search:

| inputlookup cmdb_assets.csv
| rename nt_host AS host
| rex field=host mode=sed "s/.\d+|.\w+.\w+$//" | eval host=lower(host)
| join type=left ip host
[ metadata type=hosts | rex field=host mode=sed "s/.\d+|.\w+.\w+$//" | eval host=lower(host) | rex field=host "(?\d+.\d+.\d+.\d+)"]
|where isnull(recentTime)
| fields host dns category city bunit owner recentTime ip

But it is joining on ip AND host and does not accomplish the goal. Basically, I need Splunk to try and match on either the host field or the ip field

Anyone have any ideas?

[osakachan]

What if you convert fields host and IP to one field? For example, if you priorize hostname(FDQN) over IP.

| eval newfield=if(host!="null", hostname, IP)

If you do not have values you can use | fillnull value= to control for example. That way you only need to check 1 field vs 1 field.

[kmaron]

have you tried doing 2 joins? one on IP and one on host?