Splunk Search

subsearch passing info


I perform a serach that gives me a host name, but within the returned data the event does not contain the host_ip. Within the same index, a different type of event contains both values.

I think this can be done with a subsearch?

Is there any function within splunk to enrich the original event? Like a lookup?

Tags (1)
0 Karma


Try this

<your original search> | join hostname [search sourcetype=<other event type> | fields + host_id ]
0 Karma


easier than subsearch would be :

 <your search>  hostname=* host_ip=*

as it will only return event containing value in hostname AND in host_ip

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!