Using a subsearch in a lookup

[jwhughes58]

I've got two searches I'm trying to join into one.

| localop 
| ldapsearch domain=my_domain search="(&(objectCategory=Computer)(userAccountControl:1.2.840.113556.1.4.803:=xxxx))" 
| table cn, dNSHostName

And

| makeresults 
| eval fqdn="www.usatoday.com" 
| lookup dnslookup clienthost AS fqdn OUTPUT clientip as ip

What I would like is a table that has hostname, FQDN, and IP Address.  I've tried various subsearch methods to join them, but I must have something off since I either get an error or nothing.  Any thoughts?

TIA,

Joe

[scelikok · Accepted solution]

Hi @jwhughes58,

You can simply add dnslookup into your first search. There is no need subsearch;

| localop 
| ldapsearch domain=my_domain search="(&(objectCategory=Computer)(userAccountControl:1.2.840.113556.1.4.803:=xxxx))" 
| lookup dnslookup clienthost AS dNSHostName OUTPUT clientip as ip
| table cn, dNSHostName, ip

[jwhughes58]

Doh!  There are times when I forget how Splunk works and try treating it like a programming language.

[bowesmana]

| localop 
| ldapsearch domain=my_domain search="(&(objectCategory=Computer)(userAccountControl:1.2.840.113556.1.4.803:=xxxx))" 
| table cn, dNSHostName
| append [
  | makeresults 
  | eval fqdn="www.usatoday.com" 
  | lookup dnslookup clienthost AS fqdn OUTPUT clientip as ip
]
| stats values(*) as *

or assuming that the cn is the fqdn, then this

| localop 
| ldapsearch domain=my_domain search="(&(objectCategory=Computer)(userAccountControl:1.2.840.113556.1.4.803:=xxxx))" 
| table cn, dNSHostName
| append [
  | makeresults 
  | eval fqdn="www.usatoday.com" 
  | lookup dnslookup clienthost AS fqdn OUTPUT clientip as ip
  | rename fqdn as cn
]
| stats values(*) as * by cn

[jwhughes58]

I see I explained my question badly bowesmana.  I was going to update it today with a better explanation, but scelikok answered it.  Thanks for the reply.