Splunk Search

Join on this field OR that field

bcyates
Communicator

Basically I am trying to find hosts on a csv, not sending data to splunk.

The problem is, we have to account for devices that come over with either the short name, FQDN, or the IP as the host value in Splunk.

So essentially, I would like to join on the field host OR the field IP

I have this search:

| inputlookup cmdb_assets.csv
| rename nt_host AS host
| rex field=host mode=sed "s/.\d+|.\w+.\w+$//" | eval host=lower(host)
| join type=left ip host
[ metadata type=hosts | rex field=host mode=sed "s/.\d+|.\w+.\w+$//" | eval host=lower(host) | rex field=host "(?\d+.\d+.\d+.\d+)"]
|where isnull(recentTime)
| fields host dns category city bunit owner recentTime ip

But it is joining on ip AND host and does not accomplish the goal. Basically, I need Splunk to try and match on either the host field or the ip field

Anyone have any ideas?

0 Karma

osakachan
Communicator

What if you convert fields host and IP to one field? For example, if you priorize hostname(FDQN) over IP.

| eval newfield=if(host!="null", hostname, IP)

If you do not have values you can use | fillnull value= to control for example. That way you only need to check 1 field vs 1 field.

0 Karma

kmaron
Motivator

have you tried doing 2 joins? one on IP and one on host?

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...