Splunk Search

Using a subsearch in a lookup

jwhughes58
Communicator

I've got two searches I'm trying to join into one.

 

| localop 
| ldapsearch domain=my_domain search="(&(objectCategory=Computer)(userAccountControl:1.2.840.113556.1.4.803:=xxxx))" 
| table cn, dNSHostName

 

And

 

| makeresults 
| eval fqdn="www.usatoday.com" 
| lookup dnslookup clienthost AS fqdn OUTPUT clientip as ip

 

What I would like is a table that has hostname, FQDN, and IP Address.  I've tried various subsearch methods to join them, but I must have something off since I either get an error or nothing.  Any thoughts?

TIA,

Joe

Labels (3)
0 Karma
1 Solution

scelikok
Champion

Hi @jwhughes58,

You can simply add dnslookup into your first search. There is no need subsearch;

| localop 
| ldapsearch domain=my_domain search="(&(objectCategory=Computer)(userAccountControl:1.2.840.113556.1.4.803:=xxxx))" 
| lookup dnslookup clienthost AS dNSHostName OUTPUT clientip as ip
| table cn, dNSHostName, ip
If this reply helps you an upvote is appreciated.

View solution in original post

scelikok
Champion

Hi @jwhughes58,

You can simply add dnslookup into your first search. There is no need subsearch;

| localop 
| ldapsearch domain=my_domain search="(&(objectCategory=Computer)(userAccountControl:1.2.840.113556.1.4.803:=xxxx))" 
| lookup dnslookup clienthost AS dNSHostName OUTPUT clientip as ip
| table cn, dNSHostName, ip
If this reply helps you an upvote is appreciated.

View solution in original post

jwhughes58
Communicator

Doh!  There are times when I forget how Splunk works and try treating it like a programming language.

0 Karma

bowesmana
Champion

 

| localop 
| ldapsearch domain=my_domain search="(&(objectCategory=Computer)(userAccountControl:1.2.840.113556.1.4.803:=xxxx))" 
| table cn, dNSHostName
| append [
  | makeresults 
  | eval fqdn="www.usatoday.com" 
  | lookup dnslookup clienthost AS fqdn OUTPUT clientip as ip
]
| stats values(*) as *

or assuming that the cn is the fqdn, then this

| localop 
| ldapsearch domain=my_domain search="(&(objectCategory=Computer)(userAccountControl:1.2.840.113556.1.4.803:=xxxx))" 
| table cn, dNSHostName
| append [
  | makeresults 
  | eval fqdn="www.usatoday.com" 
  | lookup dnslookup clienthost AS fqdn OUTPUT clientip as ip
  | rename fqdn as cn
]
| stats values(*) as * by cn
0 Karma

jwhughes58
Communicator

I see I explained my question badly bowesmana.  I was going to update it today with a better explanation, but scelikok answered it.  Thanks for the reply.

0 Karma