topic Re: Using Enterprise Security Identity Lookup Fields In SPL Query in Security

Using Enterprise Security Identity Lookup Fields In SPL Query

cbschreiber — Tue, 06 Apr 2021 19:00:38 GMT

I have a really simple query that I'd like to join with Enterprise Security's Identity inputlookup and grab a field from there.

Here is the simple SPL:

index=pan sourcetype="pan:system" log_subtype=globalprotect description IN ("GlobalProtect gateway client configuration generated*")
| table _time user

Trying to use a join to grab the data:

index=pan sourcetype="pan:system" log_subtype=globalprotect description IN ("GlobalProtect gateway client configuration generated*")
| join type=left overwrite=true user
[ |inputlookup my_identity_lookup | search identity=user | fields priority ]
| table _time user priority

But the priority field returns blank. Would appreciate any help fixing this!

Thanks in advance!

Re: Using Enterprise Security Identity Lookup Fields In SPL Query

bowesmana — Wed, 07 Apr 2021 01:43:07 GMT

you are joining on 'user' but you don't return user in the subsearch, only priority. Change to

| fields user priority

Re: Using Enterprise Security Identity Lookup Fields In SPL Query

scelikok — Wed, 07 Apr 2021 09:09:45 GMT

Hi @cbschreiber,

You can use lookup command without join and subsearch;

index=pan sourcetype="pan:system" log_subtype=globalprotect description IN ("GlobalProtect gateway client configuration generated*") | lookup my_identity_lookup identity AS user OUTPUT priority | table _time user priority

Re: Using Enterprise Security Identity Lookup Fields In SPL Query

cbschreiber — Wed, 07 Apr 2021 14:10:36 GMT

Hi Bowesmana,

I tried this but it did not help. Thank you for chiming in.

Re: Using Enterprise Security Identity Lookup Fields In SPL Query

cbschreiber — Wed, 07 Apr 2021 14:37:39 GMT

Hi Scelikok,

Thank you for the response. Not sure what I might be doing wrong here… but when I try this, it throws an error:

Streamed search execute failed because: Error in 'lookup' command: Could not construct lookup ‘my_identity_lookup, identity, AS, user, OUTPUT, priority'. See search.log for more details..

I tied this, which produces results

| inputlookup my_identity_lookup | where identity=“xxx.yyy"

Then tried this, which does NOT produce results

| lookup my_identity_lookup identity AS “xxx.yyy" OUTPUT priority

Thoughts on what I'm doing wrong here?

Re: Using Enterprise Security Identity Lookup Fields In SPL Query

scelikok — Wed, 07 Apr 2021 14:49:51 GMT

You must use fieldname after AS. Your base search Please try below;

| lookup my_identity_lookup identity AS user OUTPUT priority

Re: Using Enterprise Security Identity Lookup Fields In SPL Query

cbschreiber — Wed, 07 Apr 2021 15:00:11 GMT

Understood. When I try that it throws the error:

Streamed search execute failed because: Error in 'lookup' command: Could not construct lookup 'my_identity_lookup, identity, AS, user, OUTPUT, priority'. See search.log for more details..

SPL is

index=pan sourcetype="pan:system" log_subtype=globalprotect description IN ("GlobalProtect gateway client configuration generated*")
| lookup my_identity_lookup identity AS user OUTPUT priority
| table _time user priority