Splunk Search

subsearch by ip and then host

mcbradford
Contributor

I am building a dashboard based on all activity related to an IP. I have one source that generates events, but does not always include the IP. The events that do have an IP always have the host name. From one search, I want to search by IP, but also associate the IP to a host name and then search again with the host name and display all events.

Tags (1)
0 Karma

gpullis
Communicator

You're looking for something like this?

source="mySourceType" [search source="mySourceType" myIPAddressField=192.168.53.105 | fields host]
0 Karma

mcbradford
Contributor

that worked - thanks!

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!