topic Lookup Table Question in Splunk Search

Lookup Table Question

genesiusj — Fri, 27 Sep 2019 12:55:30 GMT

Hello,
This probably a stu*** question, but I am not able to find a clear answer.

My code to generate the lookup table works.
Here are the contents of my lookup table.
Input field acct Ex: user1
Output fields aid and adr Exs: 1111 and 10.10.10.10

Input field is selected from a drop down in dashboard panel.

Need to search for events containing any combination of acct, aid and/or adr.

My code results in the same events containing all 3 of these fields.
Here is my code.

index="linuxevents" AND host=ru.us AND source="/var/log/audit/audit.log" AND earliest="09/23/2019:14:28:00" AND latest="09/23/2019:14:30:00"
`comment("    AND (acct="user1" OR auid=aid OR addr=adr) ")`
| lookup myAAAlookup.csv acct
| where (acct="user1") OR (auid=aid) OR (addr=adr)
| table _time, event_id, host, acct, auid, aid, addr, adr, _raw

Note: If I comment out the where command and uncomment the matching terms AND, the same events are generated containing ALL 3 fields.

Isn't there a simple way to do this?

Thanks in advance and God bless,
Genesius

Re: Lookup Table Question

gcusello — Fri, 27 Sep 2019 13:21:08 GMT

Hi genesiusj,
let me understand:
you have a table where there are three fields the first is the key and the other two are the ones to use in search, then you wanto to search for the key and one o the other fields, is it correct?

If this is your need, try something like this:

index="linuxevents" AND host=ru.us AND source="/var/log/audit/audit.log" AND earliest="09/23/2019:14:28:00" AND latest="09/23/2019:14:30:00"
`comment("    AND (acct="user1" OR auid=aid OR addr=adr) ")`
| lookup myAAAlookup.csv acct OUTPUT aid adr
| search (acct="user1") AND (auid=aid) OR (addr=adr)
| table _time event_id host acct auid aid addr adr _raw

Bye.
Giuseppe

Re: Lookup Table Question

diogofgm — Fri, 27 Sep 2019 15:00:12 GMT

Use this:

| where (acct="user1") AND ( (auid=aid) OR (addr=adr) )

Re: Lookup Table Question

genesiusj — Sat, 28 Sep 2019 01:55:37 GMT

@gcusello
Thanks. "Nor results found."

I need to use OR OR for the 3 fields, not AND OR.
Tried this
| search (acct="onsjaro") OR (auid=aid) OR (addr=adr)
The same 18 events.

Thanks and God bless,
Genesius