topic Re: Search text list from inputlookup ignore quates in Splunk Enterprise

Search text list from inputlookup ignore quates

pkiselevs — Tue, 29 Sep 2020 17:57:07 GMT

I have some trouble with search from csv list.

If in column is two words divided with space, searching done separately for both
Example:
sourcetype="WinEventLog:Security" ("Domain Admins") - gives correct result
litsearch (index=* sourcetype="WinEventLog:Security" "Domain Admins") | fields keepcolorder=t "*" "_bkt" "_cd" "_si" "host" "index" "linecount" "source" "sourcetype" "splunk_server"

if i try to do like this with list

sourcetype="WinEventLog:Security" [| inputlookup group_list.csv |
return 10 $group_name]

normalizedSearch litsearch (index=* sourcetype="WinEventLog:Security" ((Domain Admins) OR (Domain Users))) | fields keepcolorder=t "*" "_bkt" "_cd" "_si" "host" "index" "linecount" "source" "sourcetype" "splunk_server"

group_list.csv
group_name
Domain Admins
Domain Users

this search return result where is domain , users, admin found, but not "Domain Admins".
Tried adding quotes and delimiters, but this do not help

nr,group_name,desc
1,"Domain Admins",super
2,Domain Users,standard

Re: Search text list from inputlookup ignore quates

felipesewaybric — Sun, 04 Feb 2018 23:15:12 GMT

you can try ('Domain Admins' OR 'Domain Users')?

Re: Search text list from inputlookup ignore quates

493669 — Mon, 05 Feb 2018 01:47:56 GMT

use 101010 (code sample) to post search or code

Re: Search text list from inputlookup ignore quates

pkiselevs — Tue, 29 Sep 2020 17:57:10 GMT

This option does not help, search return no hits.
litsearch (index=* sourcetype="WinEventLog:Security" (('Domain Admins') OR ('Domain Users'))) | fields keepcolorder=t "*" "_bkt" "_cd" "_si" "host" "index" "linecount" "source" "sourcetype" "splunk_server"

I think it perform 'Domain AND Admin' search not "Domain Admin"

Re: Search text list from inputlookup ignore quates

493669 — Mon, 05 Feb 2018 06:17:40 GMT

Try this:

index=*  sourcetype="WinEventLog:Security" (("Domain Admins") OR ("Domain Users"))

Let me know what output you are receiving?

Re: Search text list from inputlookup ignore quates

pkiselevs — Tue, 29 Sep 2020 17:57:12 GMT

You show me tip. I have added to csv like this
nr,group_name,desc
1,("Domain Admins"),super
2,("Domain Users"),standard

and quates are in search
normalizedSearch litsearch (index=* sourcetype="WinEventLog:Security" ("Domain Admins" OR "Domain Users")) | fields keepcolorder=t "*" "_bkt" "_cd" "_si" "host" "index" "linecount" "source" "sourcetype" "splunk_server"

Events returns exactly as from
index=* sourcetype="WinEventLog:Security" (("Domain Admins") OR ("Domain Users"))

only one moment that search is going long, but for start it is OK.

Thank you for advice!

Final search looks:

index=* sourcetype="WinEventLog:Security" [| inputlookup group_list.csv |
return 10 $group_name]

CSV

nr,group_name,desc
1,("Domain Admins"),super
2,("Domain Users"),standard

Re: Search text list from inputlookup ignore quates

pkiselevs — Tue, 29 Sep 2020 17:57:22 GMT

I have added to csv like this
nr,group_name,desc
1,("Domain Admins"),super
2,("Domain Users"),standard

and quates are in search
normalizedSearch litsearch (index= sourcetype="WinEventLog:Security" ("Domain Admins" OR "Domain Users")) | fields keepcolorder=t "" "_bkt" "_cd" "_si" "host" "index" "linecount" "source" "sourcetype" "splunk_server"

Events returns exactly as from
index=* sourcetype="WinEventLog:Security" (("Domain Admins") OR ("Domain Users"))

only one moment that search is going long, but for start it is OK.

Thank you for advice!

Final search looks:

index=* sourcetype="WinEventLog:Security" [| inputlookup group_list.csv |
return 10 $group_name]

CSV

nr,group_name,desc
1,("Domain Admins"),super
2,("Domain Users"),standard

Re: Search text list from inputlookup ignore quates

somesoni2 — Mon, 05 Feb 2018 15:59:04 GMT

Try like this

sourcetype="WinEventLog:Security" [| inputlookup group_list.csv | eval group_name="\"".group_name."\""
return 10 $group_name]

sourcetype="WinEventLog:Security" [| inputlookup group_list.csv | head 10 | table group_name | rename group_name as search]

Re: Search text list from inputlookup ignore quates

pkiselevs — Tue, 06 Feb 2018 06:13:55 GMT

return Error in 'eval' command: The expression is malformed.
return only first row in search, but is very fast

Thanks for advice