subsearch passing info

[mcbradford]

I perform a serach that gives me a host name, but within the returned data the event does not contain the host_ip. Within the same index, a different type of event contains both values.

I think this can be done with a subsearch?

Is there any function within splunk to enrich the original event? Like a lookup?

[lguinn2]

Try this

<your original search> | join hostname [search sourcetype=<other event type> | fields + host_id ]

[MarioM]

easier than subsearch would be :

 <your search>  hostname=* host_ip=*

as it will only return event containing value in hostname AND in host_ip