Splunk Search
Highlighted

Join on this field OR that field

Communicator

Basically I am trying to find hosts on a csv, not sending data to splunk.

The problem is, we have to account for devices that come over with either the short name, FQDN, or the IP as the host value in Splunk.

So essentially, I would like to join on the field host OR the field IP

I have this search:

| inputlookup cmdbassets.csv
| rename nt
host AS host
| rex field=host mode=sed "s/.\d+|.\w+.\w+$//" | eval host=lower(host)
| join type=left ip host
[ metadata type=hosts | rex field=host mode=sed "s/.\d+|.\w+.\w+$//" | eval host=lower(host) | rex field=host "(?\d+.\d+.\d+.\d+)"]
|where isnull(recentTime)
| fields host dns category city bunit owner recentTime ip

But it is joining on ip AND host and does not accomplish the goal. Basically, I need Splunk to try and match on either the host field or the ip field

Anyone have any ideas?

0 Karma
Highlighted

Re: Join on this field OR that field

Motivator

have you tried doing 2 joins? one on IP and one on host?

0 Karma
Highlighted

Re: Join on this field OR that field

Communicator

What if you convert fields host and IP to one field? For example, if you priorize hostname(FDQN) over IP.

| eval newfield=if(host!="null", hostname, IP)

If you do not have values you can use | fillnull value= to control for example. That way you only need to check 1 field vs 1 field.

0 Karma