topic Re: Why doesn't kvStore lookup work, but join does? in Splunk Enterprise

Why doesn't kvStore lookup work, but join does?

plaid_blanket — Wed, 01 Feb 2023 16:53:05 GMT

I've got a kvStore lookup, AD_Obj_user, defined with fields objectSid, OU, sAMAccountName, and others. It has case-insensitive matching.

I've got events that contain the field Sid. I want to lookup the sAMAccountName and automate the lookup, but right now not even the manual lookup works.

This works:

| inputlookup AD_Obj_User where objectSid=S-1-2-34-56789012-345678901-234567890-123456 | table objectSid sAMAccountName OU

but this does not work:

index=windows_client source="WinEventLog:PowerShell" Sid=S-1-2-34-56789012-345678901-234567890-123456 | lookup AD_Obj_User objectSid AS Sid | table OU Sid

I can do the lookup successfully, manually, by using this:

but it won't get me towards automating the lookup.

Any ideas? I'm stumped.

Re: Why doesn't kvStore lookup work, but join does?

shivanshu1593 — Wed, 01 Feb 2023 17:34:44 GMT

Try like this:

index=windows_client source="WinEventLog:PowerShell" Sid=S-1-2-34-56789012-345678901-234567890-123456 | lookup AD_Obj_User objectSid AS Sid OUTPUT objectSid as Sid | table OU Sid

++If it helps, please consider accepting as answer++

Re: Why doesn't kvStore lookup work, but join does?

plaid_blanket — Wed, 01 Feb 2023 21:12:58 GMT

Nope, no luck.

If it helps, doing the lookup DOES do something, because this

index=windows_client source="WinEventLog:PowerShell" Sid=S-1-2-34-56789012-345678901-234567890-123456 | eval objectSid="this has content" | lookup AD_Obj_User objectSid AS Sid OUTPUT objectSid | table OU Sid objectSid

returns a table that has the Sid column populated, but the other two columns blank (i.e., the lookup overwrites the "this has content" stuff in objectSid).