I'm attempting to run a given search to return bandwidth hogs by MBs downloaded. I have a search that will successfully return the values I'm after though what I'd like to do is go one step further and translate the src IP into the src Hostname for a given user (which I can do currently from the dhcp templates app).
Search for bandwidth hogs:
index=network sourcetype=firewall status=accept dst_int=port9 OR dst_int=port10 | eval mb=rcvd/1024/1024 | stats sum(mb) as "MBs Downloaded" by src app | sort -"MBs Downloaded"
Search for ip to hostname (src_ip taken from the initial search's "src" field):
eventtype=dhcpd_event src_ip=xxx.xxx.xxx.xxx | fields src_host
I'm pretty certain what I'm after can be accomplished via a subsearch but this is where I'm on shaky legs. Any help would be appreciated.
Hmm, one way to do it would be by using join, but that can be expensive.
index=network sourcetype=firewall status=accept dst_int=port9 OR dst_int=port10 | rename src AS src_ip | join src_ip [search index=<your_index> eventtype=dhcpd_event | fields src_ip, src_host] eval mb=rcvd/1024/1024 | stats sum(mb) AS "MB Downloaded" by src_ip app | sort - "MB Downloaded"
I haven't tried this out on any sample data - I just inserted the subsearch and a rename into your existing query. It will perhaps not work out of the box, and there are probably more efficient ways of doing this. Give it a try, though and let us know.