Splunk Search

relating AD logs with DHCP

krugger
Communicator

Hi,

I am trying to add a IP address hint to the Active Directory logs. I know it isn't completely reliable, but it is just to get a general ideal of the IP address the workstations had when they generate some events. Sometimes the IP is already included in the event, but most times it isn't.

They way I am trying to implement it is by building a state table with a scheduled query:
index="dhcp" (description="DNS Update Successful" OR description="Renew") | dedup hostname | outputcsv dhcpstatetable
And then using a automatic lookup to add a probableip field to the AD events.

I have the problema that the outputcsv writes the csv to /var/run which I can't use to create a lookup definition.

Is there a better way to do this?

0 Karma
1 Solution

chris
Motivator

You can create an empty dummy lookup where you need it and then use the outputlookup command to populate it.

There is an example in the documentation of the command: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Outputlookup

View solution in original post

chris
Motivator

You can create an empty dummy lookup where you need it and then use the outputlookup command to populate it.

There is an example in the documentation of the command: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Outputlookup

krugger
Communicator

outputlookup seems to solve it

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...