topic Re: Problem with a macro in Splunk Search

Problem with a macro

fdevera — Mon, 22 Jun 2020 20:11:32 GMT

`get_seclabel(host,"domain_controller","-90d")`

Macro expanded:

| inputlookup sec_label where (label="domain_controller" type="host" last_updated>=1585079881.000000)

In the input lookup there are the following columns: label, type, and value. The results of this lookup give me everything that is a domain controller. I'm trying to exclude anything that matches in the value column so I'm using this in a search but it's not excluding the list properly:

NOT
[| `get_seclabel(host,"domain_controller","-90d")`

I still see NADC01 as a returned value in my search even though I'm excluding it here. Any idea what I'm doing wrong?

Re: Problem with a macro

anilchaithu — Mon, 22 Jun 2020 20:20:32 GMT

@fdevera

I assume you are using the inputlookup as subsearch. Please output the field required from the lookup like here

NOT
[| `get_seclabel(host,"domain_controller","-90d")` | fileds value ]

and match the field name to the field name in main search. If it is host, rename value to host

NOT
[| `get_seclabel(host,"domain_controller","-90d")` | fileds value | rename value as host]

Hope this helps

Re: Problem with a macro

anilchaithu — Mon, 22 Jun 2020 21:45:41 GMT

if this helps an upvote would be appreciated