Hi,
I have a lookup file containing hostnames and IP addresses, either of which can be logged in splunk against the 'host' field.
I need to pull back the last time the device logged to Splunk using either of these fields as the 'host'. Currently the following works but only if the hostname of the devices is logging to splunk, if it's logging to splunk using the IP address as the host, this returns a null value. I need the "Latest Time" regardless of how the device is logging. Any help appreciated!!
Query:
| inputlookup devices_test.csv | join type=left [metadata type=hosts]
| eval "Latest Time"=strftime(lastTime,"%d/%m/%Y %H:%M:%S")
| eval "First Time"=strftime(firstTime,"%d/%m/%Y %H:%M:%S")
| fields host, "Latest Time", "First Time"
Lookup:
host,ipaddress
fw1,10.10.10.2
fw2,10.10.10.3
