This seems to be closer to what I need. However, the reason source1 is the first query is so I can restrict source2's events to the ones that happened BEFORE each event in source1. Otherwise, current events from source1 will show up and distort the accuracy. (that's what the _timeLESSTHANevent was for) ---Sorry weird formatting when using the less than symbol. ... View more

I have tried this query but the problem is, for example, what if someone has had this IP for 2 days? If I was looking to run query1 for the last 15 minutes, it wouldn't pick up the hostname for query2 since it was assigned much earlier. ... View more

This may help too: http://blogs.splunk.com/2013/10/31/streamstats-example/ It's an example of using streamstats but they specifically show how to look at when DHCP changes for an IP address. As to your point, if you need to search by MAC address, I would still recommend the above method. You can create a simple form dashboard that takes a MAC address and time range. You can create a search like this: host= sourcetype=dhcp mac_address=$mac$ | table _time, mac, hostname, ip_address, ... When you submit a MAC address in the form, you can have it output data however you want but in this example it would output a table of results. If you consume DHCP logs with MAC and IP address, you should be able to correlate the MAC address to a given host. ... View more

That query seemed to work, thanks! Do you know why a field would not be showing up? I have a field called "src_ip" in both events and "removal_reason" in a removed event. They both will not show values in the search. If I search in verbose mode, the values show up. ... View more

Thanks for the flowchart link - this will come in handy! ... View more

@piebob recently had me start sending out weekly featured Answers posts internally to certain teams in Splunk. Your post on alternatives to join, append and subsearches was in the first set I featured ;D ... View more

As it was you were overwriting the original value, potentially destroying evidence for debugging. However, apparently the issue was already found 🙂 ... View more