Good day,
I am trying to create a search that can first search DNS for a certain domain name and after if finds a match takes the Client IP address and search the DHCP logs for the client computer name and Mac address. point is the time for the DHCP search must be the time the DNS record was found or earlier. let me give you an example:
1- i am looking for any client that has a query for "hola.com"
2- there are 10 hits each with different times
3- i want to return the source IP address "which is the Client IP address searching for Hola" and go to DHCP logs and search for the Client name and Mac address of the user at the time he/she was resolving hola.com. so the time Latest=Time found on DNS entry and earliest=Time found on DNS entry-1day.
here is a search i have been trying to run with no luck:
index=dhcp (Action=Renew OR Action=Assign)
| eval Search_Time_From=relative_time(Time_detected,"-1d")
| where earliest=Search_Time_From AND latest=Time_detected [search eventtype=dnsout DNS_Query="*hola*" |dedup Client_IP consecutive=true
| eval Time_detected =_time
| fields Time_detected Client_IP]|lookup Computers MACAddress as MAC_Address Outputnew|lookup Users Logon_Name as UserID OUTPUTnew |dedup Client_IP Action consecutive=true |table _time host ServerLoc_Time Client_Name Client_IP MAC_Address UserID Display_Name Action
Thanks for your help
