I perform a serach that gives me a host name, but within the returned data the event does not contain the host_ip. Within the same index, a different type of event contains both values.
I think this can be done with a subsearch?
Is there any function within splunk to enrich the original event? Like a lookup?
<your original search> | join hostname [search sourcetype=<other event type> | fields + host_id ]
easier than subsearch would be :
<your search> hostname=* host_ip=*
as it will only return event containing value in hostname AND in host_ip