topic Re: How to search Events on Hosts in Inputlookup File? in Splunk Search

How to search Events on Hosts in Inputlookup File?

Kendo213 — Wed, 14 Mar 2018 14:56:17 GMT

I have a CSV that I've created via ldapsearch, that contains a single column with 'cn' and then a list of servers.

I want to search a sourcetype on each of these servers for a keyword.

I'm having difficulty figuring this out. Any ideas?

Re: How to search Events on Hosts in Inputlookup File?

tiagofbmm — Wed, 14 Mar 2018 15:25:31 GMT

Try this code, it creates and ORed list of the servers in the cn name and passes that to a search.

search [| inputlookup yourlookup.csv | eval host=cn | return host]

Is that what you intend?

Re: How to search Events on Hosts in Inputlookup File?

Kendo213 — Wed, 14 Mar 2018 15:30:13 GMT

I have this, however it's really slow...Is there a faster way to get this to run? Basically we're wanting to narrow down Windows Install events to servers, and not desktops.

index=systems sourcetype=WindowsUpdateLog eventtype=Update_Successful [inputlookup serverlist.csv | table cn | rename cn as host] | stats count by host

Would it be faster to have an inputlookup with workstation names and just a where clause host != workstationname?

Re: How to search Events on Hosts in Inputlookup File?

tiagofbmm — Wed, 14 Mar 2018 15:38:58 GMT

Unfortunately you are searching a non indexed field named eventtype. If you were;t your performance would be x1000 like this

But unless you start indexing that....

Re: How to search Events on Hosts in Inputlookup File?

tiagofbmm — Wed, 14 Mar 2018 15:40:21 GMT

Your suggestion would worsen things even more. Because you would be doing the statistics over all the events instead of starting by filtering them right away

Re: How to search Events on Hosts in Inputlookup File?

Kendo213 — Wed, 14 Mar 2018 15:44:19 GMT

This does return much faster. Could you explain from a technical perspective why that is?

Thanks

Re: How to search Events on Hosts in Inputlookup File?

tiagofbmm — Wed, 14 Mar 2018 15:51:13 GMT

If you just test this part, | inputlookup yourlookup.csv | eval host=cn | return host

You'll see it returns an OR list of the hosts

Re: How to search Events on Hosts in Inputlookup File?

Kendo213 — Wed, 14 Mar 2018 16:05:22 GMT

I do see that, however it's only returning the first host in the results. Is that expected?

Re: How to search Events on Hosts in Inputlookup File?

tiagofbmm — Wed, 14 Mar 2018 16:10:41 GMT

Yes I forgot to put the count.

| inputlookup yourlookup.csv | eval host=cn | return host count=10000

Re: How to search Events on Hosts in Inputlookup File?

Kendo213 — Wed, 14 Mar 2018 19:20:45 GMT

This seems to cut off about 30 seconds on average.

index=systems sourcetype=WindowsUpdateLog "Installation started" | search [inputlookup serverlist.csv | rename cn as host] | stats count by host

I'm not sure from a Splunk perspective why that is, but it seems to work and run quickly (last run was 2 seconds vs 39)

Re: How to search Events on Hosts in Inputlookup File?

tiagofbmm — Wed, 14 Mar 2018 19:26:12 GMT

Please don't forget to accept the answer and upvote