I have a search that shows network activity destined for specific IP addresses I'm interested in:
host="logserver" 1.2.3.4 OR 4.5.6.7 OR | dedup src | table src,_time
"src" is an extracted field showing the source IPs which have sent traffic to the destination IPs listed in the search.
I want to take each result row and perform another search on this data, to look up the MAC address from the DHCP logs. Unfortunately, time becomes a limiting factor here. The output of the first search shows when the communication took place, but the DHCP log will be at a time previous to this.
I have another search that I can plug in IP & time pairs to output the MAC address:
host=logserver $IP$
timeformat="$tf$" endtime="$ts$"
| table _time dhcp_mac_addr
| head 1
This search uses input fields from a dashboard to allow the user to enter the "IP", "TF" and "TS" variables.
Put simply, I want to append a column to the end of the statistics table output by the first search, to show the "dhcp_mac_addr" field extracted from the second search, with the IP and TS values passed between the two searches.
Subsearches don't seem to allow passing variables between them and the data isn't two tables which can be easily JOINED together (due to the time differences).
Is there a way to create a search "function" which can be called for each search result row (e.g. mac_add_lookup("IP","TS"))? That would be ideal....
↧