Splunk Search

relating AD logs with DHCP

Communicator

Hi,

I am trying to add a IP address hint to the Active Directory logs. I know it isn't completely reliable, but it is just to get a general ideal of the IP address the workstations had when they generate some events. Sometimes the IP is already included in the event, but most times it isn't.

They way I am trying to implement it is by building a state table with a scheduled query:
index="dhcp" (description="DNS Update Successful" OR description="Renew") | dedup hostname | outputcsv dhcpstatetable
And then using a automatic lookup to add a probableip field to the AD events.

I have the problema that the outputcsv writes the csv to /var/run which I can't use to create a lookup definition.

Is there a better way to do this?

0 Karma
1 Solution

Motivator

You can create an empty dummy lookup where you need it and then use the outputlookup command to populate it.

There is an example in the documentation of the command: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Outputlookup

View solution in original post

Motivator

You can create an empty dummy lookup where you need it and then use the outputlookup command to populate it.

There is an example in the documentation of the command: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Outputlookup

View solution in original post

Communicator

outputlookup seems to solve it

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!