If you use a script like powershell, just make a loop and print everything as key="value", for example you data you look like: 2014-11-06T04:10:09.000+10:00, AppPoolName="TestApp", PrivateMemory=2000, State="Started",... If you data is already a hash is very simple to make a loop, if the data is a single string, you might need to split by ":" to load it into a hash table first. As you are already using Scripted Input, a few more lines on your script will save heaps of time on the Splunk side. ... View more

Would eval + return work for you? For example: mysearch |timechart avg(secs) by city|eval baseline=[search mysearch earliest=-30d latest=now |stats avg(secs) as baseline|return $baseline] The other option might be appendcols , but I never used it... ... View more

Hi Rdunn, I believe you're in the right way... join would be the command here. Let's see if I can build a search command using the information you provide in your question. First let's see if I'm taking the right assumptions: The search below will list the DHCP events, containing the dest_ip(s) ** used by the Host(s) you're investigating:** sourcetype=dhcpsrvlog description=Assign OR description=Renew [|inputlookup hostwatchlist] | dedup dest_host sortby -_time Now to join it with the web_threat events you need first to have the a field name in common. Apparently the joining key here is the Host's IP, in this case dest_ip from DHCP log and src_ip from Webthreat logs. Here how you could join both: sourcetype=dhcpsrvlog description=Assign OR description=Renew [|inputlookup hostwatchlist] | dedup dest_host sortby -_time | join type=inner max=0 dest_ip [ search sourcetype=web_threat dst_hostname=badsite.com | rename src_ip AS dest_ip ] | table _time, dest_host, dest_ip, dst_hostname *Note that I renamed the field src_ip. Just to give you a bit of explanation, the join command needs two things to match events between the searches: same field name and same field content - both are CASE-SENSITIVE! The type=right tells to list only values that have matches... you could use type=left if you wish to list events from DHCP logs independent if they have or don't have matching events from the join operation. The max=0 tells to match all events, the default is 1. Also the join command by default overwrite the fields, in other word, the search inside the join will return, for example _time field and this will be used at the output, overwriting the _time from the first search. As a suggestion you might want have the dst_hostname as another lookup to make you like easier instead to add it directly to the search. Anyway, hope I was able to help. Cheers ... View more

Do you already have the lookup working for the matching ones? If yes, just use a | fillnull -value "any_any" rule_name ... View more